CVE-2024-33599
📋 TL;DR
A stack-based buffer overflow vulnerability in nscd (Name Service Cache Daemon) allows attackers to execute arbitrary code or crash the service when netgroup cache is exhausted. This affects systems running glibc 2.15 or later with nscd enabled. Only the nscd binary itself is vulnerable, not other glibc components.
💻 Affected Systems
- glibc
- nscd
📦 What is this software?
Glibc by Gnu
The GNU C Library (glibc) is the core C library for Linux systems, providing essential system calls and basic functions for all C programs. It is a fundamental component that nearly every Linux application depends on.
Learn more about Glibc →⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with nscd privileges (typically root), leading to complete system compromise.
Likely Case
Denial of service through nscd crash, disrupting name service caching and potentially affecting authentication/authorization.
If Mitigated
Limited impact if nscd is disabled or properly firewalled, with only local exploitation possible.
🎯 Exploit Status
Requires exhausting the fixed-size cache first, then triggering netgroup request. Local access typically needed unless nscd is network-exposed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: glibc 2.39 or distribution-specific backports
Vendor Advisory: https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0005
Restart Required: Yes
Instructions:
1. Update glibc package via distribution package manager. 2. Restart nscd service: 'systemctl restart nscd' or '/etc/init.d/nscd restart'. 3. Verify nscd is running with updated glibc.
🔧 Temporary Workarounds
Disable nscd
linuxStop and disable the nscd service if not required
systemctl stop nscd
systemctl disable nscd
Disable netgroup caching
linuxConfigure nscd to disable netgroup caching
echo 'enable-cache netgroup no' >> /etc/nscd.conf
systemctl restart nscd
🧯 If You Can't Patch
- Disable nscd service entirely if not needed
- Restrict network access to nscd (port 0.0.0.0:0) and ensure it only listens locally
🔍 How to Verify
Check if Vulnerable:
Check glibc version: 'ldd --version | head -1' and verify nscd is running: 'systemctl status nscd' or 'ps aux | grep nscd'Check Version:
ldd --version | head -1Verify Fix Applied:
Verify glibc version is patched (2.39+ or distribution backport) and nscd restarted successfully📡 Detection & Monitoring
Log Indicators:
- nscd crash logs in /var/log/messages or journalctl
- unusual netgroup query patterns
Network Indicators:
- Excessive nscd requests from single source
- nscd port (typically local) exposed to network
SIEM Query:
process_name:nscd AND (event_type:crash OR exit_code:139)🔗 References
- http://www.openwall.com/lists/oss-security/2024/07/22/5
- https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html
- https://security.netapp.com/advisory/ntap-20240524-0011/
- https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0005
- http://www.openwall.com/lists/oss-security/2024/07/22/5
- https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html
- https://security.netapp.com/advisory/ntap-20240524-0011/
- https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0005
