p PatchFirst

CVE-2024-10396

CVE-2024-10396 · Fileserver crash and possible information leak on StoreACL/FetchACL

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An authenticated user can provide a malformed ACL to the fileserver's StoreACL RPC, causing the fileserver to crash, possibly expose uninitialized memory, and possibly store garbage data in the audit log. Malformed ACLs provided in responses to client FetchACL RPCs can cause client processes to crash and possibly expose uninitialized memory into other ACLs stored on the server.

CVSS 6.5 · Medium · EPSS 0.6% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • openafs

    Versions
    • ≥ 1.0, < 1.6.24: Affected (semver)
    • ≥ 1.8.0, < 1.8.12.2: Affected (semver)
    • ≥ 1.9.0, < 1.9.1: Affected (semver)

    Update to 1.6.24; Update to 1.8.12.2; Update to 1.9.1

  • openafs Debian:12

    Versions
    • 1.8.9-1
    Affected ranges
    • ECOSYSTEM: < 1.8.9-1+deb12u1

    Update to 1.8.9-1+deb12u1

  • openafs Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.8.13-1

    Update to 1.8.13-1

  • openafs Ubuntu:16.04:LTS

    Versions
    • 1.6.14-1
    • 1.6.15-1
    • 1.6.15-1ubuntu1
    • 1.6.15-1ubuntu1.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openafs Ubuntu:18.04:LTS

    Versions
    • 1.6.21-3
    • 1.6.21-3ubuntu1
    • 1.6.22-3
    • 1.8.0~pre4-1
    • 1.8.0~pre5-1
    • 1.8.0~pre5-1ubuntu1
    • 1.8.0~pre5-1ubuntu1.1
    • 1.8.0~pre5-1ubuntu1.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openafs Ubuntu:20.04:LTS

    Versions
    • 1.8.4~pre1-1ubuntu2
    • 1.8.4~pre1-1ubuntu2.1
    • 1.8.4~pre1-1ubuntu2.2
    • 1.8.4~pre1-1ubuntu2.3
    • 1.8.4~pre1-1ubuntu2.4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openafs Ubuntu:22.04:LTS

    Versions
    • 1.8.6-5ubuntu2
    • 1.8.8-3
    • 1.8.8.1-1
    • 1.8.8.1-3ubuntu2~22.04.1
    • 1.8.8.1-3ubuntu2~22.04.2
    • 1.8.10-2ubuntu1~22.04.1
    • 1.8.10-2ubuntu1~22.04.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openafs Ubuntu:24.04:LTS

    Versions
    • 1.8.10-1ubuntu2
    • 1.8.10-1ubuntu3
    • 1.8.10-1ubuntu4
    • 1.8.10-1ubuntu6
    • 1.8.10-2ubuntu1
    • 1.8.10-2.1ubuntu1
    • 1.8.10-2.1ubuntu2
    • 1.8.10-2.1ubuntu3
    • 1.8.10-2.1ubuntu3.1
    • 1.8.10-2.1ubuntu3.2
    • 1.8.10-2.1ubuntu3.3
    • 1.8.10-2.1ubuntu3.4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →