CVE-2024-33600: GNU glibc nscd DoS Vulnerability

CVE-2024-33600 Overview

CVE-2024-33600 is a null pointer dereference vulnerability affecting the Name Service Cache Daemon (nscd) in the GNU C Library (glibc). When the nscd cache fails to add a not-found netgroup response to the cache, client requests can result in a null pointer dereference, causing the daemon to crash. This flaw was introduced in glibc 2.15 when the cache was added to nscd and affects only the nscd binary.

Critical Impact

Remote attackers can trigger denial of service conditions by causing the nscd daemon to crash through specially crafted netgroup lookup requests, potentially disrupting name resolution services across affected systems.

Affected Products

• GNU glibc (versions 2.15 and later)
• Debian Linux 10.0
• NetApp Active IQ Unified Manager (VMware vSphere)
• NetApp H-Series (H300S, H500S, H700S, H410S, H410C, H610C, H610S, H615C)
• NetApp HCI Bootstrap OS

Discovery Timeline

• May 6, 2024 - CVE-2024-33600 published to NVD
• June 18, 2025 - Last updated in NVD database

Technical Details for CVE-2024-33600

Vulnerability Analysis

The vulnerability exists within the nscd (Name Service Cache Daemon) component of glibc, specifically in the handling of netgroup cache entries. When a netgroup lookup returns a "not-found" response, the nscd attempts to cache this negative result. However, if the cache addition fails for any reason (such as memory allocation failure or cache capacity issues), the subsequent code path does not properly handle this failure case.

The code proceeds to dereference a pointer that should have been set during the cache addition but remains null due to the failure. This null pointer dereference causes the nscd process to crash, effectively creating a denial of service condition for all services relying on nscd for name resolution caching.

Since nscd is commonly used in enterprise environments to improve performance of name service lookups (user/group names, hostnames, etc.), a crash can have cascading effects on authentication, network services, and application functionality.

Root Cause

The root cause is improper error handling in the nscd cache management code (CWE-476: NULL Pointer Dereference). When adding a not-found netgroup response to the cache fails, the code does not validate that required data structures were properly initialized before attempting to use them. This missing null check was introduced in glibc version 2.15 when netgroup caching functionality was added to nscd.

Attack Vector

The attack can be performed remotely over the network. An attacker needs to trigger conditions where:

1. A netgroup lookup request is made to nscd
2. The lookup returns a "not-found" response
3. The cache addition operation fails (which may occur naturally under resource constraints or could potentially be influenced by the attacker)

When these conditions align, the null pointer dereference occurs, crashing the nscd daemon. The attack does not require authentication or user interaction, though the attack complexity is considered high due to the need for specific cache failure conditions.

The vulnerability mechanism involves the cache response handling in nscd. When a netgroup query results in a not-found response, the daemon attempts to cache this negative result to avoid repeated lookups. If the addgrbyX cache function fails to properly allocate and initialize the response structure, subsequent code that expects valid data will dereference a null pointer. For detailed technical analysis, see the glibc Advisory GLIBC-SA-2024-0006.

Detection Methods for CVE-2024-33600

Indicators of Compromise

• Unexpected nscd daemon crashes or restarts in system logs
• Core dump files generated by nscd in /var/core/ or configured core dump directories
• Spike in netgroup-related lookup failures across dependent services
• System log entries indicating segmentation faults in nscd (e.g., kernel: nscd[PID]: segfault)

Detection Strategies

• Monitor nscd process stability using process monitoring tools (systemd, monit, or custom scripts)
• Configure auditd rules to track nscd crashes: auditctl -w /usr/sbin/nscd -p x -k nscd_monitor
• Implement log correlation rules to detect repeated nscd restarts within short timeframes
• Use SentinelOne's behavioral AI to detect anomalous daemon crash patterns indicative of exploitation attempts

Monitoring Recommendations

• Enable core dump collection for nscd with appropriate disk space limits
• Configure alerting on nscd service restarts via systemctl or init monitoring
• Monitor /var/log/syslog and /var/log/messages for nscd-related error messages
• Implement service availability monitoring for nscd on port 80 (if configured) or via socket status

How to Mitigate CVE-2024-33600

Immediate Actions Required

• Update glibc to the latest patched version provided by your distribution
• If immediate patching is not possible, consider disabling nscd netgroup caching as a temporary workaround
• Implement service monitoring and automatic restart for nscd to minimize downtime during exploitation attempts
• Review and apply vendor-specific patches from NetApp and Debian if using affected products

Patch Information

Security patches addressing this vulnerability are available from multiple sources. Refer to the following vendor advisories for specific patch information:

• glibc Advisory GLIBC-SA-2024-0006 - Official glibc security advisory with patch details
• Debian LTS Announcement - Debian Long Term Support security update
• NetApp Security Advisory - NetApp product-specific patches

Update your system using the appropriate package manager for your distribution (e.g., apt update && apt upgrade for Debian-based systems).

Workarounds

• Disable netgroup caching in nscd by setting enable-cache netgroup no in /etc/nscd.conf
• Alternatively, disable nscd entirely if name service caching is not critical for your environment
• Implement rate limiting on netgroup lookups if application architecture permits
• Use alternative caching mechanisms such as sssd where applicable

# Configuration example - Disable netgroup caching in nscd
# Edit /etc/nscd.conf and add or modify the following line:
echo "enable-cache netgroup no" >> /etc/nscd.conf

# Restart nscd to apply changes
systemctl restart nscd

# Verify the configuration is active
grep "enable-cache.*netgroup" /etc/nscd.conf