CVE-2024-33602

CVE Details

Release Date:

2024-04-24

Description

nscd: netgroup cache assumes NSS callback uses in-buffer strings\nThe Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory\nwhen the NSS callback does not store all strings in the provided buffer.\nThe flaw was introduced in glibc 2.15 when the cache was added to nscd.\nThis vulnerability is only present in the nscd binary.

See more information about CVE-2024-33602 from MITRE CVE dictionary and NIST NVD

CVSS Scoring

NOTE: The following CVSS v3.1 metrics and score provided are preliminary and subject to review.

Base Score:	4	CVSS Vector:	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack Vector:	Local network	Attack Complexity:	Low
Privileges Required:	None	User Interaction:	None
Scope:	Unchanged	Confidentiality Impact:	None
Integrity Impact:	None	Availability Impact:	Low

Errata information

Platform	Errata	Release Date
Oracle Linux version 7 (glibc)	ELSA-2024-12442	2024-06-18
Oracle Linux version 7 (glibc)	ELSA-2024-12444	2024-06-19
Oracle Linux version 7 (glibc)	ELSA-2024-3588	2024-06-05
Oracle Linux version 8 (glibc)	ELSA-2024-12440	2024-06-17
Oracle Linux version 8 (glibc)	ELSA-2024-3344	2024-05-29
Oracle Linux version 9 (glibc)	ELSA-2024-12472	2024-07-03
Oracle Linux version 9 (glibc)	ELSA-2024-3339	2024-05-29

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team