CVE-2024-33602: 
NixOS vulnerability analysis and mitigation

The Name Service Cache Daemon's (nscd) netgroup cache vulnerability (CVE-2024-33602) was discovered in GNU C Library (glibc) versions 2.15 through 2.39.9000. The vulnerability was introduced in glibc 2.15 when the netgroup cache was added to nscd and is only present in the nscd binary. The flaw was disclosed on April 24, 2024, and can lead to memory corruption when the NSS callback does not store all strings in the provided buffer (GLIBC Advisory, NVD).

The vulnerability stems from an assumption in the netgroup cache code that the NSS callback uses in-buffer strings. However, there is no guarantee from the NSS callback API that the returned strings are all within the buffer. When the NSS callback stores strings outside the provided buffer, the buffer resizing logic can lead to potential memory corruption. The vulnerability has been assigned a CVSS v3.1 base score of 7.4 (HIGH) with the vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (NetApp Advisory).

Successful exploitation of this vulnerability could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). The vulnerability affects the memory handling capabilities of the Name Service Cache Daemon, potentially compromising system security and stability (NetApp Advisory).

The vulnerability requires local access and high attack complexity, as indicated by the CVSS vector. While public discussion of this vulnerability exists, detailed exploit information has not been publicly disclosed (NetApp Advisory).

The vulnerability has been fixed in GNU C Library version 2.40 and backported to earlier versions. Multiple vendors have released patches for their affected systems. For Debian 10 buster, the fix is available in version 2.28-10+deb10u4 (Debian Advisory). Users are advised to upgrade their glibc packages to the patched versions.

The vulnerability was publicly announced on the oss-security mailing list along with four other CVEs as part of the GNU C Library version 2.40 release. The announcement included detailed information about the nature of the vulnerability and its fixes (OSS Security).