CVE-2024-33600: 
NixOS vulnerability analysis and mitigation

CVE-2024-33600 is a vulnerability in the Name Service Cache Daemon (nscd) discovered in May 2024. The vulnerability affects GNU C Library (glibc) versions 2.15 through 2.39.9000, specifically in the nscd binary. The flaw was introduced in glibc 2.15 when the cache was added to nscd (GLIBC Advisory).

When the Name Service Cache Daemon's (nscd) cache fails to add a not-found netgroup response to the cache, the client request can result in a null pointer dereference. This vulnerability is classified as CWE-476 (NULL Pointer Dereference). The CVSS score for this vulnerability is 5.3 (MEDIUM) with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (NetApp Advisory).

Successful exploitation of this vulnerability could lead to Denial of Service (DoS) conditions. The vulnerability only affects the nscd binary component of the GNU C Library (NetApp Advisory).

The vulnerability is network-accessible and requires low complexity to exploit, with no privileges or user interaction needed. Public discussion of this vulnerability has been acknowledged by security researchers (NetApp Advisory).

The vulnerability has been fixed in GNU C Library version 2.40. Multiple vendors have released security updates to address this vulnerability. For example, Debian has fixed this issue in version 2.28-10+deb10u4 for Debian 10 buster (Debian Advisory). Red Hat has also released security updates for affected versions (OSS Security).