Bug 772425 (CVE-2021-27645)

Summary:	<sys-libs/glibc-2.33 : Double free in nscd (CVE-2021-27645)
Product:	Gentoo Security	Reporter:	Sam James <sam>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://sourceware.org/bugzilla/show_bug.cgi?id=27462
Whiteboard:	B3 [glsa+ cve]
Package list:		Runtime testing required:	---
Bug Depends on:	793692
Bug Blocks:

Description Sam James archtester

2021-02-24 19:14:25 UTC

Description:
"The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in degraded service or Denial of Service on the local system. This is related to netgroupcache.c."

Comment 1 Sam James archtester

2021-02-24 19:14:46 UTC

Guarded behind USE=nscd (non-default).

Comment 2 Sam James archtester

2021-03-03 18:13:33 UTC

Fix: https://sourceware.org/git/?p=glibc.git;a=commit;h=dca565886b5e8bd7966e15f0ca42ee5cff686673

Comment 3 Larry the Git Cow gentoo-dev

2021-06-13 14:28:41 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2e0e1c0418c63f7bdbecc980817b11adc09cfdd8

commit 2e0e1c0418c63f7bdbecc980817b11adc09cfdd8
Author:     Andreas K. Hüttel <dilfridge@gentoo.org>
AuthorDate: 2021-06-13 14:17:15 +0000
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: 2021-06-13 14:17:15 +0000

    package.mask: Extend glibc mask to <2.33
    
    Bug: https://bugs.gentoo.org/772425
    Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>

 profiles/package.mask | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comment 4 Andreas K. Hüttel archtester

2021-07-01 21:32:18 UTC

Nothing to do for toolchain here anymore

Comment 5 John Helmert III archtester

2021-07-05 02:39:15 UTC

New request filed

Comment 6 GLSAMaker/CVETool Bot gentoo-dev

2021-07-06 03:42:05 UTC

This issue was resolved and addressed in
 GLSA 202107-07 at https://security.gentoo.org/glsa/202107-07
by GLSA coordinator John Helmert III (ajak).