Medium severity · published Nov 14, 2024
CVE-2024-10396
Fileserver crash and possible information leak on StoreACL/FetchACL
6.5
CVSS
0.6%
EPSS
No
On KEV
Description
An authenticated user can provide a malformed ACL to the fileserver's StoreACL RPC, causing the fileserver to crash, possibly expose uninitialized memory, and possibly store garbage data in the audit log. Malformed ACLs provided in responses to client FetchACL RPCs can cause client processes to crash and possibly expose uninitialized memory into other ACLs stored on the server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
OpenAFS · The OpenAFS Foundation
1.0 before 1.6.24; 1.8.0 before 1.8.12.2; 1.9.0 before 1.9.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-10396
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-10396
www.openafs.org
https://www.openafs.org/pages/security/OPENAFS-SA-2024-002.txt
www.openafs.org
https://www.openafs.org/security
lists.debian.org
https://lists.debian.org/debian-lts-announce/2025/05/msg00019.html
More from OpenAFS
7.8
CVE-2024-10397
Preallocated buffer overflows in XDR responses
7.8
CVE-2024-10394
Theft of credentials in Unix client PAGs