Bug 2277202 (CVE-2024-33599) - CVE-2024-33599 glibc: stack-based buffer overflow in netgroup cache
Summary: CVE-2024-33599 glibc: stack-based buffer overflow in netgroup cache
Keywords:
Status: NEW
Alias: CVE-2024-33599
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 2277207
TreeView+ depends on / blocked
 
Reported: 2024-04-25 17:24 UTC by Robb Gatica
Modified: 2024-06-12 20:43 UTC (History)
41 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A stack-based buffer overflow flaw was found in the glibc netgroup cache. In certain conditions, its possible to trigger a stack-based buffer overflow condition that can lead to a denial of service and potentially other malicious actions that impact confidentiality and integrity.
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2024:2851 0 None None None 2024-05-15 02:09:11 UTC
Red Hat Product Errata RHBA-2024:3360 0 None None None 2024-05-28 08:18:29 UTC
Red Hat Product Errata RHBA-2024:3361 0 None None None 2024-05-28 08:25:20 UTC
Red Hat Product Errata RHBA-2024:3362 0 None None None 2024-05-28 08:29:45 UTC
Red Hat Product Errata RHBA-2024:3363 0 None None None 2024-05-28 08:32:42 UTC
Red Hat Product Errata RHBA-2024:3364 0 None None None 2024-05-28 08:25:06 UTC
Red Hat Product Errata RHBA-2024:3365 0 None None None 2024-05-28 08:32:00 UTC
Red Hat Product Errata RHBA-2024:3366 0 None None None 2024-05-28 08:30:00 UTC
Red Hat Product Errata RHBA-2024:3367 0 None None None 2024-05-28 08:23:51 UTC
Red Hat Product Errata RHBA-2024:3370 0 None None None 2024-05-28 09:57:14 UTC
Red Hat Product Errata RHBA-2024:3371 0 None None None 2024-05-28 08:50:04 UTC
Red Hat Product Errata RHBA-2024:3373 0 None None None 2024-05-28 09:31:12 UTC
Red Hat Product Errata RHBA-2024:3375 0 None None None 2024-05-28 09:28:55 UTC
Red Hat Product Errata RHBA-2024:3376 0 None None None 2024-05-28 09:29:00 UTC
Red Hat Product Errata RHBA-2024:3377 0 None None None 2024-05-28 09:32:42 UTC
Red Hat Product Errata RHBA-2024:3378 0 None None None 2024-05-28 09:56:33 UTC
Red Hat Product Errata RHBA-2024:3379 0 None None None 2024-05-28 09:28:21 UTC
Red Hat Product Errata RHBA-2024:3380 0 None None None 2024-05-28 09:00:14 UTC
Red Hat Product Errata RHBA-2024:3382 0 None None None 2024-05-28 08:59:28 UTC
Red Hat Product Errata RHBA-2024:3383 0 None None None 2024-05-28 09:19:26 UTC
Red Hat Product Errata RHBA-2024:3386 0 None None None 2024-05-28 11:40:01 UTC
Red Hat Product Errata RHBA-2024:3389 0 None None None 2024-05-28 12:18:04 UTC
Red Hat Product Errata RHBA-2024:3390 0 None None None 2024-05-28 12:26:42 UTC
Red Hat Product Errata RHBA-2024:3393 0 None None None 2024-05-28 12:35:51 UTC
Red Hat Product Errata RHBA-2024:3398 0 None None None 2024-05-28 13:00:47 UTC
Red Hat Product Errata RHBA-2024:3413 0 None None None 2024-05-28 13:07:46 UTC
Red Hat Product Errata RHBA-2024:3425 0 None None None 2024-05-28 13:29:59 UTC
Red Hat Product Errata RHBA-2024:3430 0 None None None 2024-05-28 13:13:59 UTC
Red Hat Product Errata RHBA-2024:3436 0 None None None 2024-05-28 13:54:44 UTC
Red Hat Product Errata RHBA-2024:3448 0 None None None 2024-05-29 07:59:26 UTC
Red Hat Product Errata RHBA-2024:3449 0 None None None 2024-05-29 07:59:42 UTC
Red Hat Product Errata RHBA-2024:3450 0 None None None 2024-05-29 07:59:57 UTC
Red Hat Product Errata RHBA-2024:3451 0 None None None 2024-05-29 08:00:12 UTC
Red Hat Product Errata RHBA-2024:3452 0 None None None 2024-05-29 08:00:27 UTC
Red Hat Product Errata RHBA-2024:3453 0 None None None 2024-05-29 08:00:54 UTC
Red Hat Product Errata RHBA-2024:3454 0 None None None 2024-05-29 08:01:16 UTC
Red Hat Product Errata RHBA-2024:3455 0 None None None 2024-05-29 08:01:01 UTC
Red Hat Product Errata RHBA-2024:3456 0 None None None 2024-05-29 07:52:18 UTC
Red Hat Product Errata RHBA-2024:3457 0 None None None 2024-05-29 07:52:33 UTC
Red Hat Product Errata RHBA-2024:3458 0 None None None 2024-05-29 07:52:45 UTC
Red Hat Product Errata RHBA-2024:3459 0 None None None 2024-05-29 07:52:57 UTC
Red Hat Product Errata RHBA-2024:3463 0 None None None 2024-05-29 08:14:59 UTC
Red Hat Product Errata RHBA-2024:3465 0 None None None 2024-05-29 12:56:52 UTC
Red Hat Product Errata RHBA-2024:3468 0 None None None 2024-05-29 14:05:30 UTC
Red Hat Product Errata RHBA-2024:3474 0 None None None 2024-05-29 16:14:01 UTC
Red Hat Product Errata RHBA-2024:3477 0 None None None 2024-05-29 19:10:49 UTC
Red Hat Product Errata RHBA-2024:3505 0 None None None 2024-05-30 13:25:48 UTC
Red Hat Product Errata RHBA-2024:3506 0 None None None 2024-05-30 13:21:18 UTC
Red Hat Product Errata RHBA-2024:3508 0 None None None 2024-05-30 13:28:45 UTC
Red Hat Product Errata RHBA-2024:3509 0 None None None 2024-05-30 13:36:01 UTC
Red Hat Product Errata RHBA-2024:3510 0 None None None 2024-05-30 13:33:29 UTC
Red Hat Product Errata RHBA-2024:3511 0 None None None 2024-05-30 13:39:26 UTC
Red Hat Product Errata RHBA-2024:3531 0 None None None 2024-05-31 16:35:05 UTC
Red Hat Product Errata RHBA-2024:3532 0 None None None 2024-05-31 16:31:08 UTC
Red Hat Product Errata RHBA-2024:3547 0 None None None 2024-06-03 10:45:13 UTC
Red Hat Product Errata RHBA-2024:3548 0 None None None 2024-06-03 11:34:52 UTC
Red Hat Product Errata RHBA-2024:3554 0 None None None 2024-06-03 14:26:29 UTC
Red Hat Product Errata RHBA-2024:3584 0 None None None 2024-06-04 11:22:53 UTC
Red Hat Product Errata RHBA-2024:3615 0 None None None 2024-06-04 18:13:42 UTC
Red Hat Product Errata RHBA-2024:3616 0 None None None 2024-06-04 18:16:04 UTC
Red Hat Product Errata RHBA-2024:3628 0 None None None 2024-06-05 10:05:48 UTC
Red Hat Product Errata RHBA-2024:3645 0 None None None 2024-06-05 21:01:22 UTC
Red Hat Product Errata RHBA-2024:3651 0 None None None 2024-06-05 21:41:03 UTC
Red Hat Product Errata RHBA-2024:3678 0 None None None 2024-06-06 11:09:17 UTC
Red Hat Product Errata RHBA-2024:3703 0 None None None 2024-06-06 14:42:18 UTC
Red Hat Product Errata RHBA-2024:3734 0 None None None 2024-06-10 00:33:09 UTC
Red Hat Product Errata RHBA-2024:3735 0 None None None 2024-06-10 01:01:43 UTC
Red Hat Product Errata RHBA-2024:3853 0 None None None 2024-06-11 22:16:01 UTC
Red Hat Product Errata RHBA-2024:3870 0 None None None 2024-06-12 19:32:00 UTC
Red Hat Product Errata RHBA-2024:3873 0 None None None 2024-06-12 20:43:37 UTC
Red Hat Product Errata RHSA-2024:2799 0 None None None 2024-05-09 14:48:11 UTC
Red Hat Product Errata RHSA-2024:3309 0 None None None 2024-05-23 06:25:12 UTC
Red Hat Product Errata RHSA-2024:3312 0 None None None 2024-05-23 07:18:47 UTC
Red Hat Product Errata RHSA-2024:3339 0 None None None 2024-05-23 13:20:39 UTC
Red Hat Product Errata RHSA-2024:3344 0 None None None 2024-05-23 18:49:51 UTC
Red Hat Product Errata RHSA-2024:3411 0 None None None 2024-05-28 14:27:40 UTC
Red Hat Product Errata RHSA-2024:3423 0 None None None 2024-05-28 14:06:20 UTC
Red Hat Product Errata RHSA-2024:3464 0 None None None 2024-05-29 08:28:29 UTC
Red Hat Product Errata RHSA-2024:3588 0 None None None 2024-06-04 14:20:20 UTC

Description Robb Gatica 2024-04-25 17:24:31 UTC
A stack-based buffer overflow in nscd was reported and assigned CVE-2024-33599.

Reference: https://sourceware.org/bugzilla/show_bug.cgi?id=31677

---

nscd/netgroupcache.c (addinnetgrX):

497   struct indataset
498   {
499     struct datahead head;
500     innetgroup_response_header resp;
501   } *dataset
502       = (struct indataset *) mempool_alloc (db,
503                                             sizeof (*dataset) + req->key_len,
504                                             1);

mempool_alloc fails and returns NULL.


This is possible if posix_fallocate fails and the retry fails.

505   struct indataset dataset_mem;
506   bool cacheable = true;
507   if (__glibc_unlikely (dataset == NULL))
508     {
509       cacheable = false;
510       dataset = &dataset_mem;

This structure has no room for req->key_len material.

511     }
512 
513   datahead_init_pos (&dataset->head, sizeof (*dataset) + req->key_len,
514                      sizeof (innetgroup_response_header),
515                      he == NULL ? 0 : dh->nreloads + 1, result->head.ttl);
516   /* Set the notfound status and timeout based on the result from
517      getnetgrent.  */
518   dataset->head.notfound = result->head.notfound;
519   dataset->head.timeout = timeout;
520 
521   dataset->resp.version = NSCD_VERSION;
522   dataset->resp.found = result->resp.found;
523   /* Until we find a matching entry the result is 0.  */
524   dataset->resp.result = 0;
525 
526   char *key_copy = memcpy ((char *) (dataset + 1), group, req->key_len);

This copies up to req->key_len material to a structure that has no storage space for it.

This was detected by static code analysis.

It will only happen in the case the database runs out of memory/storage while expanding the netgroup cache.

The group entries overwrite other data on the stack after dataset_mem.

The workaround is not to cache the netgroup if this is impacting the use of the application.

Comment 5 errata-xmlrpc 2024-05-09 14:48:09 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2024:2799 https://access.redhat.com/errata/RHSA-2024:2799

Comment 6 errata-xmlrpc 2024-05-23 06:25:07 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Telecommunications Update Service
  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions

Via RHSA-2024:3309 https://access.redhat.com/errata/RHSA-2024:3309

Comment 7 errata-xmlrpc 2024-05-23 07:18:43 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:3312 https://access.redhat.com/errata/RHSA-2024:3312

Comment 8 errata-xmlrpc 2024-05-23 13:20:34 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:3339 https://access.redhat.com/errata/RHSA-2024:3339

Comment 9 errata-xmlrpc 2024-05-23 18:49:47 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:3344 https://access.redhat.com/errata/RHSA-2024:3344

Comment 10 errata-xmlrpc 2024-05-28 14:06:16 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2024:3423 https://access.redhat.com/errata/RHSA-2024:3423

Comment 11 errata-xmlrpc 2024-05-28 14:27:37 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:3411 https://access.redhat.com/errata/RHSA-2024:3411

Comment 12 errata-xmlrpc 2024-05-29 08:28:24 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support

Via RHSA-2024:3464 https://access.redhat.com/errata/RHSA-2024:3464

Comment 13 errata-xmlrpc 2024-06-04 14:20:16 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2024:3588 https://access.redhat.com/errata/RHSA-2024:3588


Note You need to log in before you can comment on or make changes to this bug.