CVE-2024-33602

nscd: netgroup cache assumes NSS callback uses in-buffer strings The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory when the NSS callback does not store all strings in the provided buffer. The flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
eglibc	24.04 LTS noble	Not in release
	23.10 mantic	Not in release
	22.04 LTS jammy	Not in release
	20.04 LTS focal	Not in release
	14.04 LTS trusty	Needs evaluation
glibc	24.04 LTS noble	Fixed 2.39-0ubuntu8.2
	23.10 mantic	Fixed 2.38-1ubuntu6.3
	22.04 LTS jammy	Fixed 2.35-0ubuntu3.8
	20.04 LTS focal	Fixed 2.31-0ubuntu9.16
	18.04 LTS bionic	Fixed 2.27-3ubuntu1.6+esm3 Ubuntu Pro
	16.04 LTS xenial	Fixed 2.23-0ubuntu11.3+esm7 Ubuntu Pro

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro

Notes

mdeslaur

same commits as CVE-2024-33601

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
glibc	Upstream: https://sourceware.org/git?p=glibc.git;a=commit;h=c04a21e050d64a1193a6daab872bca2528bda44b Upstream: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=a9a8d3eebb145779a18d90e3966009a1daa63cd8 Upstream: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=71af8ca864345d39b746d5cee84b94b430fad5db Upstream: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=6e106dc214d6a033a4e945d1c6cf58061f1c5f1f Upstream: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=b6742463694b1dfdd5120b91ee21cf05d15ec2e2 Upstream: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=7a5864cac60e06000394128a5a2817b03542f5a3 Upstream: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=86f1d5f4129c373ac6fb6df5bcf38273838843cb Upstream: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=4d27d4b9a188786fc6a56745506cec2acfc51f83 Upstream: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=3ed195a8ec89da281e3c4bf887a13d281b72d8f4 Upstream: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=bbf5a58ccb55679217f94de706164d15372fbbc0

Package

Patch details

glibc

References

Related Ubuntu Security Notices (USN)

USN-6804-1
GNU C Library vulnerabilities
31 May 2024

CVE-2024-33602

Status

Get expanded security coverage with Ubuntu Pro

Notes

Patch details

References

Related Ubuntu Security Notices (USN)

Other references