Fedora 39 : glibc (2024-df41d584d0)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##
# The descriptive text and package checks in this plugin were
# extracted from Fedora Security Advisory FEDORA-2024-df41d584d0
#

include('compat.inc');

if (description)
{
  script_id(209838);
  script_version("1.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/21");

  script_cve_id(
    "CVE-2024-33599",
    "CVE-2024-33600",
    "CVE-2024-33601",
    "CVE-2024-33602"
  );
  script_xref(name:"FEDORA", value:"2024-df41d584d0");
  script_xref(name:"IAVA", value:"2025-A-0062-S");

  script_name(english:"Fedora 39 : glibc (2024-df41d584d0)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Fedora host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the
FEDORA-2024-df41d584d0 advisory.

    Auto-sync with upstream branch release/2.38/master

    - Add BuildRequires:gzip for compressed character maps and info files.

    Upstream commit: 4dd8641461463b667b5503ab0ea4abcf261378a9

    - Add crt1-2.0.o for glibc 2.0 compatibility tests
    - libio: Attempt wide backup free only for non-legacy code
    - nptl: Use <support/check.h> facilities in tst-setuid3
    - posix: Use <support/check.h> facilities in tst-truncate and tst-truncate64
    - ungetc: Fix backup buffer leak on program exit [BZ #27821]
    - ungetc: Fix uninitialized read when putting into unused streams [BZ #27821]
    - Make tst-ungetc use libsupport
    - stdio-common: Add test for vfscanf with matches longer than INT_MAX [BZ #27650]
    - support: Add FAIL test failure helper
    - x86: Fix bug in strchrnul-evex512 [BZ #32078]
    - Fix name space violation in fortify wrappers (bug 32052)
    - resolv: Fix tst-resolv-short-response for older GCC (bug 32042)
    - Update syscall lists for Linux 6.5
    - Add mremap tests
    - mremap: Update manual entry
    - linux: Update the mremap C implementation [BZ #31968]
    - resolv: Track single-request fallback via _res._flags (bug 31476)
    - resolv: Do not wait for non-existing second DNS response after error (bug 30081)
    - resolv: Allow short error responses to match any query (bug 31890)
    - Linux: Make __rseq_size useful for feature detection (bug 31965)
    - elf: Make dl-rseq-symbols Linux only
    - nptl: fix potential merge of __rseq_* relro symbols
    - s390x: Fix segfault in wcsncmp [BZ #31934]
    - misc: Add support for Linux uio.h RWF_NOAPPEND flag
    - i386: Disable Intel Xeon Phi tests for GCC 15 and above (BZ 31782)
    - Force DT_RPATH for --enable-hardcoded-path-in-tests
    - resolv: Fix some unaligned accesses in resolver [BZ #30750]
    - nscd: Use time_t for return type of addgetnetgrentX
    - elf: Also compile dl-misc.os with $(rtld-early-cflags)
    - CVE-2024-33601, CVE-2024-33602: nscd: netgroup: Use two buffers in addgetnetgrentX (bug 31680)
    - CVE-2024-33600: nscd: Avoid null pointer crashes after notfound response (bug 31678)
    - CVE-2024-33600: nscd: Do not send missing not-found response in addgetnetgrentX (bug 31678)
    - CVE-2024-33599: nscd: Stack-based buffer overflow in netgroup cache (bug 31677)
    - i386: ulp update for SSE2 --disable-multi-arch configurations
    - nptl: Fix tst-cancel30 on kernels without ppoll_time64 support
    - login: structs utmp, utmpx, lastlog _TIME_BITS independence (bug 30701)
    - login: Check default sizes of structs utmp, utmpx, lastlog
    - sparc: Remove 64 bit check on sparc32 wordsize (BZ 27574)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bodhi.fedoraproject.org/updates/FEDORA-2024-df41d584d0");
  script_set_attribute(attribute:"solution", value:
"Update the affected glibc package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-33602");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2024-33599");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/05/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/10/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/10/28");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:39");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:glibc");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Fedora Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2024-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include('rpm.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/RedHat/release');
if (isnull(os_release) || 'Fedora' >!< os_release) audit(AUDIT_OS_NOT, 'Fedora');
var os_ver = pregmatch(pattern: "Fedora.*release ([0-9]+)", string:os_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Fedora');
os_ver = os_ver[1];
if (! preg(pattern:"^39([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, 'Fedora 39', 'Fedora ' + os_ver);

if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Fedora', cpu);

var pkgs = [
    {'reference':'glibc-2.38-19.fc39', 'release':'FC39', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var el_string = NULL;
  var rpm_spec_vers_cmp = NULL;
  var epoch = NULL;
  var allowmaj = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
  if (reference && _release) {
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'glibc');
}