CVE-2024-33602: debian debian_linux
CVSS: 7.4v3.1HighModified
AliasesUBUNTU-CVE-2024-33602DEBIAN-CVE-2024-33602CGA-f4cr-gr22-4q8xCGA-j245-pcp9-fhpf
Published 06-05-2024Last modified 15-10-2026
Vulnerability summary
CVE-2024-33602 is a high (CVSS 7.4) vulnerability in debian debian_linux. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 33% of scored vulnerabilities.
CVSS score
7.4/10
010
High · v3.1 (CVE.org)EPSS score
0.40%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 19 · Related 9DLA-3850-1DSA-5678-1MGASA-2024-0173OPENSUSE-SU-2024:13991-1RHSA-2024:2799RHSA-2024:3309RHSA-2024:3312RHSA-2024:3339RHSA-2024:3344RHSA-2024:3411RHSA-2024:3423RHSA-2024:3464RHSA-2024:3588SUSE-SU-2024:1675-1SUSE-SU-2024:1895-1SUSE-SU-2024:1895-2SUSE-SU-2024:1977-1SUSE-SU-2025:20038-1USN-6804-1CGA-W326-HMV5-P22RCGA-WFXF-8642-F6F5
Timeline
- 06-05-2024PublishedVulnerability first disclosed.
- 15-10-2026Last modifiedVulnerability information updated.
Description
nscd: netgroup cache assumes NSS callback uses in-buffer strings The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory when the NSS callback does not store all strings in the provided buffer. The flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.
CVSS metrics
6 scores · 6 sources · 1 versionHigh 7.4Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated7.4HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.4HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated7.4HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated7.4HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST7.4HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.40%
Chance of exploitation in the next 30 days
Percentile
33%
Versus all other CVEs
30-day change
0.00 pp
From 0.40% on 18-09-2026
18-09-202618-10-2026
EPSS score0.40%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian2 products
- glibc< 2.36-9+deb12u7 | < 2.37-19
- debian_linuxEOL10.0
Ubuntu2 products
- eglibcAll versions (No fix recorded)
- glibc< 2.23-0ubuntu11.3+esm7 | < 2.27-3ubuntu1.6+esm3 | < 2.31-0ubuntu9.16 | < 2.35-0ubuntu3.8 | < 2.39-0ubuntu8.2
Chainguard1 product
- glibc< 2.39-r5
Gnu1 product
- glibc≥ 2.15, < 2.40
The gnu c library1 product
- glibc≥ 2.15, < 2.40
Wolfi1 product
- glibc< 2.39-r5
7 vendors · 17 products
