CVE-2024-33602

What it actually does

The nscd netgroup cache can corrupt memory when the NSS callback does not store all strings in the provided buffer, introduced in glibc 2.15 and present only in the nscd binary.

Why it matters to the business

Systems using nscd for netgroup caching face risk of local memory corruption that may lead to service crashes or code execution, potentially allowing compromise of affected hosts without remote access.

How an attack unfolds

A local attacker configures an NSS module or environment that triggers netgroup cache lookups in nscd, supplying a callback returning strings outside the expected buffer to induce memory corruption and achieve code execution.

How to fix it

Upgrade glibc to a build containing commit 3d1aed874918c466a4477af1da35983ab036690e. Disable or remove the nscd binary if netgroup caching is unnecessary.

How to confirm the fix worked

Confirm glibc packages contain the referenced commit or later, restart nscd, and validate netgroup caching behavior under controlled NSS callback tests for absence of corruption.

Typical attack path

1. Obtain local access on a target system running nscd
2. Set up or modify an NSS configuration to affect netgroup lookups
3. Trigger netgroup cache operations within nscd
4. Leverage resulting memory corruption for arbitrary code execution or denial of service

How to detect it

Inspect nscd process logs and system crash reports for memory corruption signals tied to netgroup cache operations; review NSS configuration changes on hosts running nscd.

What your security team should do

• Apply the glibc update containing commit 3d1aed874918c466a4477af1da35983ab036690e across all affected systems
• Review and minimize use of nscd where netgroup functionality is not required
• Include nscd memory error monitoring in routine host integrity checks