CVE-2024-33601

What it actually does

nscd netgroup cache uses xmalloc/xrealloc which terminate the daemon process on allocation failure instead of handling errors gracefully, resulting in denial of service to name service clients.

Why it matters to the business

Systems using nscd for name resolution experience sudden daemon crashes under memory pressure, interrupting cached lookups and causing application delays or failures until the service restarts.

How an attack unfolds

An attacker triggers netgroup cache operations via name service queries while the system is under memory pressure, causing an allocation failure that invokes the terminating malloc wrapper and crashes the nscd process.

How to fix it

Upgrade glibc to a version containing commit 3d1aed874918c466a4477af1da35983ab036690e or later; restart nscd after update; consider disabling netgroup caching if immediate patching is not feasible.

How to confirm the fix worked

Confirm glibc version contains commit 3d1aed874918c466a4477af1da35983ab036690e; test nscd under simulated memory pressure to verify graceful handling instead of termination; monitor process stability during cache operations.

Typical attack path

1. Identify hosts running nscd with netgroup caching enabled
2. Generate name service requests that populate or query the netgroup cache
3. Induce memory pressure on the target system to force allocation failure during cache handling
4. Observe daemon termination and resulting loss of cached name resolution for clients

How to detect it

Review system and daemon logs for nscd crashes or abrupt terminations correlated with netgroup cache activity; look for memory allocation failure messages around the time of process exit.

What your security team should do

• Prioritize patching glibc on all systems running nscd to the fixed commit
• Audit configurations to disable unnecessary netgroup caching
• Implement process monitoring and automatic restart for nscd
• Review memory limits and resource constraints on affected hosts