CVE-2024-33601

The Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or xrealloc and these functions may terminate the process due to a memory allocation failure resulting in a denial of service to the clients. The flaw was introduced in glibc 2.15 when the cache was added to nscd.

This vulnerability is only present in the nscd binary.

References

Affected packages

Debian:11 / glibc

Package

Name: glibc
Purl: pkg:deb/debian/glibc?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.31-13+deb11u10

Affected versions

2.*

2.31-13

2.31-13+deb11u1

2.31-13+deb11u2

2.31-13+deb11u3

2.31-13+deb11u4

2.31-13+deb11u5

2.31-13+deb11u6

2.31-13+deb11u7

2.31-13+deb11u8

2.31-13+deb11u9

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / glibc

Package

Name: glibc
Purl: pkg:deb/debian/glibc?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.36-9+deb12u7

Affected versions

2.*

2.36-9

2.36-9+deb12u1

2.36-9+deb12u2

2.36-9+deb12u3

2.36-9+deb12u4

2.36-9+deb12u5

2.36-9+deb12u6

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / glibc

Package

Name: glibc
Purl: pkg:deb/debian/glibc?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.37-19

Affected versions

2.*

2.36-9

2.36-9+loong64

2.36-10~0

2.37-1

2.37-2

2.37-3

2.37-4

2.37-5

2.37-6

2.37-7

2.37-8

2.37-9

2.37-10

2.37-11

2.37-12

2.37-13

2.37-14

2.37-15~deb13u1

2.37-15

2.37-15.1

2.37-15.1+sh4

2.37-16

2.37-17

2.37-18

Ecosystem specific

{
    "urgency": "not yet assigned"
}