CVE-2024-33600 nscd: Null pointer crashes after notfound response

2024-05-0619:22:02

CWE-476

glibc

github.com

cve-2024-33600

null pointer

nscd

cache daemon

glibc 2.15

6.1 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

nscd: Null pointer crashes after notfound response

If the Name Service Cache Daemon’s (nscd) cache fails to add a not-found
netgroup response to the cache, the client request can result in a null
pointer dereference. This flaw was introduced in glibc 2.15 when the
cache was added to nscd.

This vulnerability is only present in the nscd binary.

CNA Affected

[
  {
    "vendor": "The GNU C Library",
    "product": "glibc",
    "versions": [
      {
        "status": "affected",
        "version": "2.15",
        "lessThan": "2.40",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  }
]