CVE-2015-7510

This flaw is like a “traffic cop” that checks user and group names. If someone sends specially crafted requests, that traffic cop can overflow its memory—leading to a crash, and in the worst case, giving an attacker control of the machine. Because it’s reachable from the network without needing an account, it can be triggered from outside if your system is accessible.

This affects you if you run systemd on your servers (typical for many Linux-based production systems) and your environment allows the user/group lookup path in the nss-mymachines NSS module to be reached. It matters most when network access is available to whatever service routes to that lookup logic—because authentication and user interaction are not required. It’s only a risk when the vulnerability is reachable from the network in your setup (reachable in default configuration per the findings).

Treat this as urgent because remote attackers can exploit it without authentication or user interaction, and it’s reachable in default configuration. The findings indicate public Proof-of-Concept material exists, and there has been rising attention, so you should patch promptly rather than waiting.

1. Confirm exposure (operational check)

   • Determine which Linux distribution and version you run on systems using systemd.
   • Check whether the systemd NSS module nss-mymachines is present and enabled, and whether your user/group lookups route through it (for example, via name-service calls that involve getpwnam/getgrnam behavior).
   • Confirm whether the relevant network-facing service(s) are reachable from untrusted networks (since the findings say the vulnerability is reachable over the network and reachable in default config).

2. Apply the fix

   • Upgrade systemd (and any associated NSS/NSS-module packages) to the vendor-fixed state referenced in the findings: Red Hat Bug 1284642 and the upstream systemd change associated with the provided commit/issue.
   • If you manage many hosts, schedule a controlled rollout (patch window + reboot/service restarts as required by your distribution).
   • Note: the findings do not list explicit version numbers, so your package manager and vendor advisories will be the source of truth for the exact fixed build.

3. If patching is delayed (temporary mitigation)

   • Reduce exposure by restricting inbound network access to the servers that could route requests to the affected lookup path.
   • Segregate the server network so untrusted clients cannot reach the relevant network-facing entry points.
   • During the interim, prioritize monitoring for crashes and repeated lookup failures, since the finding includes the ability to crash the system.

4. Validate after patch

   • Verify services are stable and that lookups continue to work normally.
   • Check system logs around the time of any network activity for signs of crashes or anomalous name-service/lookup errors.

5. Ongoing monitoring

   • Continue monitoring for unexpected restarts, core dumps, or repeated errors tied to user/group lookup functionality until you confirm the fixed package is deployed everywhere.

CVE-2015-7510 is a CWE-119 issue (stack-based buffer overflow) in the NSS module nss-mymachines within systemd, specifically in getpwnam and getgrnam. The findings state remote attackers can send specially crafted network data to trigger the overflow without authentication and without user interaction, and that it is reachable in default configuration. A public proof-of-concept exists (one known), which increases the likelihood of real-world attempts. KEV does not list it, and the provided EPSS is a prediction only; the findings do not claim confirmed exploitation, but given remote/no-auth reachability and the existence of PoC, it should be treated as high priority. “KEV not listed” means CISA did not include it in the known exploited catalog at the time of the provided finding.