Every CVE Search/ Get API key

CVE-2024-10394

Theft of credentials in Unix client PAGs

8.4 HighFix available

A local user can bypass the OpenAFS PAG (Process Authentication Group) throttling mechanism in Unix clients, allowing the user to create a PAG using an existing id number, effectively joining the PAG and letting the user steal the credentials in that PAG.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.20%Up 0.2 points since Nov 15, 2024
90%50%10%1%

What each source reports

CVE List Score used 8.4

Theft of credentials in Unix client PAGs

A local user can bypass the OpenAFS PAG (Process Authentication Group) throttling mechanism in Unix clients, allowing the user to create a PAG using an existing id number, effectively joining the PAG and letting the user steal the credentials in that PAG.

Record
CVE-2024-10394
CVSS 4.0
8.4 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-305
Updated
2026-11-02
EUVDEUVD-2024-33418 8.4

A local user can bypass the OpenAFS PAG (Process Authentication Group) throttling mechanism in Unix clients, allowing the user to create a PAG using an existing id number, effectively joining the PAG and letting the user steal the credentials in that PAG.

Record
EUVD-2024-33418
CVSS 4.0
8.4 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-263m-wcmp-r5j6 8.4

A local user can bypass the OpenAFS PAG (Process Authentication Group) throttling mechanism in...

A local user can bypass the OpenAFS PAG (Process Authentication Group) throttling mechanism in Unix clients, allowing the user to create a PAG using an existing id number, effectively joining the PAG and letting the user steal the credentials in that PAG.

Record
GHSA-263m-wcmp-r5j6
CVSS 4.0
8.4 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
0.0 NoneCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N
Weakness
CWE-190, CWE-305
Updated
2026-11-02
NVD 8.4

A local user can bypass the OpenAFS PAG (Process Authentication Group) throttling mechanism in Unix clients, allowing the user to create a PAG using an existing id number, effectively joining the PAG and letting the user steal the credentials in that PAG.

Record
CVE-2024-10394
CVSS 4.0
8.4 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-305
Updated
2026-11-02
OSV 8.4

Theft of credentials in Unix client PAGs

A local user can bypass the OpenAFS PAG (Process Authentication Group) throttling mechanism in Unix clients, allowing the user to create a PAG using an existing id number, effectively joining the PAG and letting the user steal the credentials in that PAG.

Record
CVE-2024-10394
CVSS 4.0
8.4 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-305
Updated
2026-11-02
OSVDEBIAN-CVE-2024-10394 7.8

A local user can bypass the OpenAFS PAG (Process Authentication Group) throttling mechanism in Unix clients, allowing the user to create a PAG using an existing id number, effectively joining the PAG and letting the user steal the credentials in that PAG.

Record
DEBIAN-CVE-2024-10394
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2024-10394 8.4

A local user can bypass the OpenAFS PAG (Process Authentication Group) throttling mechanism in Unix clients, allowing the user to create a PAG using an existing id number, effectively joining the PAG and letting the user steal the credentials in that PAG.

Record
UBUNTU-CVE-2024-10394
CVSS 4.0
8.4 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2025-0013 No score

Updated openafs packages fix security vulnerabilities

A local user can bypass the OpenAFS PAG (Process Authentication Group) throttling mechanism in Unix client. (CVE-2024-10394) An authenticated user can provide a malformed ACL to the fileserver's StoreACL RPC, causing the fileserver to crash. (CVE-2024-10396) A malicious server can crash the OpenAFS cache manager and other client utilities, and possibly execute arbitrary code. (CVE-2024-10397)

Record
MGASA-2025-0013
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openafs
Debian:12
 before 1.8.9-1+deb12u1, plus listed versions
1.8.9-1
1.8.9-1+deb12u1
openafs
Debian:13
 before 1.8.13-1
1.8.13-1
openafs
Debian:11
From an advisory covering 3 CVEs
 before 1.8.6-5+deb11u1, plus listed versions
1.8.6-5
1.8.6-5+deb11u1
openafs
Debian:12
From an advisory covering 3 CVEs
 before 1.8.9-1+deb12u1, plus listed versions
1.8.9-1
1.8.9-1+deb12u1
openafs
Mageia:9
From an advisory covering 3 CVEs
 before 1.8.13.1-1.mga9
1.8.13.1-1.mga9
openafs
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.6.14-11.6.15-11.6.15-1ubuntu11.6.15-1ubuntu1.1
 None known
openafs
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.6.21-31.6.21-3ubuntu11.6.22-31.8.0~pre4-11.8.0~pre5-11.8.0~pre5-1ubuntu11.8.0~pre5-1ubuntu1.11.8.0~pre5-1ubuntu1.2
 None known
openafs
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.8.4~pre1-1ubuntu21.8.4~pre1-1ubuntu2.11.8.4~pre1-1ubuntu2.21.8.4~pre1-1ubuntu2.31.8.4~pre1-1ubuntu2.4
 None known
openafs
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.8.6-5ubuntu21.8.8-31.8.8.1-11.8.8.1-3ubuntu2~22.04.11.8.8.1-3ubuntu2~22.04.21.8.10-2ubuntu1~22.04.11.8.10-2ubuntu1~22.04.2
 None known
openafs
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.8.10-1ubuntu21.8.10-1ubuntu31.8.10-1ubuntu41.8.10-1ubuntu61.8.10-2ubuntu1
Show 7 moreShow less
1.8.10-2.1ubuntu11.8.10-2.1ubuntu21.8.10-2.1ubuntu31.8.10-2.1ubuntu3.11.8.10-2.1ubuntu3.21.8.10-2.1ubuntu3.31.8.10-2.1ubuntu3.4
 None known

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-10394 is a high vulnerability (CVSS 8.4) in Openafs, published November 14, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 10th percentile. Fixed in openafs 1.8.9-1+deb12u1.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open