Every CVE Search/ Get API key

CVE-2024-10396

Fileserver crash and possible information leak on StoreACL/FetchACL

6.5 MediumFix available

An authenticated user can provide a malformed ACL to the fileserver's StoreACL RPC, causing the fileserver to crash, possibly expose uninitialized memory, and possibly store garbage data in the audit log. Malformed ACLs provided in responses to client FetchACL RPCs can cause client processes to crash and possibly expose uninitialized memory into other ACLs stored on the server.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.56%Up 0.5 points since Nov 15, 2024
90%50%10%1%

What each source reports

CVE List Score used 6.5

Fileserver crash and possible information leak on StoreACL/FetchACL

An authenticated user can provide a malformed ACL to the fileserver's StoreACL RPC, causing the fileserver to crash, possibly expose uninitialized memory, and possibly store garbage data in the audit log. Malformed ACLs provided in responses to client FetchACL RPCs can cause client processes to crash and possibly expose uninitialized memory into other ACLs stored on the server.

Record
CVE-2024-10396
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-772
Updated
2026-11-02
EUVDEUVD-2024-33419 6.5

An authenticated user can provide a malformed ACL to the fileserver's StoreACL RPC, causing the fileserver to crash, possibly expose uninitialized memory, and possibly store garbage data in the audit log. Malformed ACLs provided in responses to client FetchACL RPCs can cause client processes to crash and possibly expose uninitialized memory into other ACLs stored on the server.

Record
EUVD-2024-33419
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-mqv3-f225-3xw2 7.1

An authenticated user can provide a malformed ACL to the fileserver's StoreACL RPC, causing the...

An authenticated user can provide a malformed ACL to the fileserver's StoreACL RPC, causing the fileserver to crash, possibly expose uninitialized memory, and possibly store garbage data in the audit log. Malformed ACLs provided in responses to client FetchACL RPCs can cause client processes to crash and possibly expose uninitialized memory into other ACLs stored on the server.

Record
GHSA-mqv3-f225-3xw2
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
0.0 NoneCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N
Weakness
CWE-772, CWE-1286
Updated
2026-11-02
NVD 6.5

An authenticated user can provide a malformed ACL to the fileserver's StoreACL RPC, causing the fileserver to crash, possibly expose uninitialized memory, and possibly store garbage data in the audit log. Malformed ACLs provided in responses to client FetchACL RPCs can cause client processes to crash and possibly expose uninitialized memory into other ACLs stored on the server.

Record
CVE-2024-10396
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-772
Updated
2026-11-02
OSV 6.5

Fileserver crash and possible information leak on StoreACL/FetchACL

An authenticated user can provide a malformed ACL to the fileserver's StoreACL RPC, causing the fileserver to crash, possibly expose uninitialized memory, and possibly store garbage data in the audit log. Malformed ACLs provided in responses to client FetchACL RPCs can cause client processes to crash and possibly expose uninitialized memory into other ACLs stored on the server.

Record
CVE-2024-10396
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-772
Updated
2026-11-02
OSVDEBIAN-CVE-2024-10396 6.5

An authenticated user can provide a malformed ACL to the fileserver's StoreACL RPC, causing the fileserver to crash, possibly expose uninitialized memory, and possibly store garbage data in the audit log. Malformed ACLs provided in responses to client FetchACL RPCs can cause client processes to crash and possibly expose uninitialized memory into other ACLs stored on the server.

Record
DEBIAN-CVE-2024-10396
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2024-10396 7.1

An authenticated user can provide a malformed ACL to the fileserver's StoreACL RPC, causing the fileserver to crash, possibly expose uninitialized memory, and possibly store garbage data in the audit log. Malformed ACLs provided in responses to client FetchACL RPCs can cause client processes to crash and possibly expose uninitialized memory into other ACLs stored on the server.

Record
UBUNTU-CVE-2024-10396
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2025-0013 No score

Updated openafs packages fix security vulnerabilities

A local user can bypass the OpenAFS PAG (Process Authentication Group) throttling mechanism in Unix client. (CVE-2024-10394) An authenticated user can provide a malformed ACL to the fileserver's StoreACL RPC, causing the fileserver to crash. (CVE-2024-10396) A malicious server can crash the OpenAFS cache manager and other client utilities, and possibly execute arbitrary code. (CVE-2024-10397)

Record
MGASA-2025-0013
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openafs
Debian:12
 before 1.8.9-1+deb12u1, plus listed versions
1.8.9-1
1.8.9-1+deb12u1
openafs
Debian:13
 before 1.8.13-1
1.8.13-1
openafs
Debian:11
From an advisory covering 3 CVEs
 before 1.8.6-5+deb11u1, plus listed versions
1.8.6-5
1.8.6-5+deb11u1
openafs
Debian:12
From an advisory covering 3 CVEs
 before 1.8.9-1+deb12u1, plus listed versions
1.8.9-1
1.8.9-1+deb12u1
openafs
Mageia:9
From an advisory covering 3 CVEs
 before 1.8.13.1-1.mga9
1.8.13.1-1.mga9
openafs
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.6.14-11.6.15-11.6.15-1ubuntu11.6.15-1ubuntu1.1
 None known
openafs
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.6.21-31.6.21-3ubuntu11.6.22-31.8.0~pre4-11.8.0~pre5-11.8.0~pre5-1ubuntu11.8.0~pre5-1ubuntu1.11.8.0~pre5-1ubuntu1.2
 None known
openafs
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.8.4~pre1-1ubuntu21.8.4~pre1-1ubuntu2.11.8.4~pre1-1ubuntu2.21.8.4~pre1-1ubuntu2.31.8.4~pre1-1ubuntu2.4
 None known
openafs
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.8.6-5ubuntu21.8.8-31.8.8.1-11.8.8.1-3ubuntu2~22.04.11.8.8.1-3ubuntu2~22.04.21.8.10-2ubuntu1~22.04.11.8.10-2ubuntu1~22.04.2
 None known
openafs
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.8.10-1ubuntu21.8.10-1ubuntu31.8.10-1ubuntu41.8.10-1ubuntu61.8.10-2ubuntu1
Show 7 moreShow less
1.8.10-2.1ubuntu11.8.10-2.1ubuntu21.8.10-2.1ubuntu31.8.10-2.1ubuntu3.11.8.10-2.1ubuntu3.21.8.10-2.1ubuntu3.31.8.10-2.1ubuntu3.4
 None known

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-10396 is a medium vulnerability (CVSS 6.5) in Openafs, published November 14, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.56%, the 46th percentile. Fixed in openafs 1.8.9-1+deb12u1.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open