{"id":"CVE-2018-16948","aliases":["DEBIAN-CVE-2018-16948","DLA-1513-1","DSA-4302-1","EUVD-2018-8736","GHSA-q586-r5vx-jgjf","MGASA-2019-0021","UBUNTU-CVE-2018-16948","openSUSE-SU-2024:11113-1"],"status":"published","title":"An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several RPC server...","description":"An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several RPC server routines did not fully initialize their output variables before returning, leaking memory contents from both the stack and the heap. Because the OpenAFS cache manager functions as an Rx server for the AFSCB service, clients are also susceptible to information leakage. For example, RXAFSCB_TellMeAboutYourself leaks kernel memory and KAM_ListEntry leaks kaserver memory.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01992,"percentile":0.80824,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2018-09-12T01:00:00Z","modified":"2026-10-23T18:03:28Z","fixes":[{"ecosystem":"Debian:12","package":"openafs","fixed_in":["1.8.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openafs","fixed_in":["1.8.2-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"openafs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"openafs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"openafs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.9-2+deb8u8"}]}],"versions":["1.6.9-2+deb8u2","1.6.9-2+deb8u3","1.6.9-2+deb8u4","1.6.9-2+deb8u4~bpo70+1","1.6.9-2+deb8u5","1.6.9-2+deb8u6","1.6.9-2+deb8u7"],"bundled":3},{"source":"osv","ecosystem":"Debian:9","package":"openafs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.20-2+deb9u2"}]}],"versions":["1.6.20-2","1.6.20-2+deb9u1"],"bundled":3},{"source":"osv","ecosystem":"Mageia:6","package":"openafs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.23-1.mga6"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"openafs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.14-1","1.6.15-1","1.6.15-1ubuntu1","1.6.15-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openafs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.21-3","1.6.21-3ubuntu1","1.6.22-3","1.8.0~pre4-1","1.8.0~pre5-1","1.8.0~pre5-1ubuntu1","1.8.0~pre5-1ubuntu1.1","1.8.0~pre5-1ubuntu1.2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openafs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.8-1.13"}]}],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"openafs","product":"openafs"}],"references":[{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00024.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2018/dsa-4302","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://openafs.org/pages/security/OPENAFS-SA-2018-002.txt","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-16948"},{"url":"https://github.com/advisories/GHSA-q586-r5vx-jgjf"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-16948","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0021.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23663","tags":["report"]},{"url":"https://openafs.org/pages/security/OPENAFS-SA-2018-001.txt","tags":["web"]},{"url":"https://openafs.org/pages/security/OPENAFS-SA-2018-002.txt","tags":["web"]},{"url":"https://openafs.org/pages/security/OPENAFS-SA-2018-003.txt","tags":["web"]},{"url":"http://openafs.org/dl/openafs/1.6.23/RELNOTES-1.6.23","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-16948","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-16948","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16949","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-16948","description":"An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several RPC server routines did not fully initialize their output variables before returning, leaking memory contents from both the stack and the heap. Because the OpenAFS cache manager functions as an Rx server for the AFSCB service, clients are also susceptible to information leakage. For example, RXAFSCB_TellMeAboutYourself leaks kernel memory and KAM_ListEntry leaks kaserver memory.","status":"published","published":"2018-09-12T01:00:00Z","modified":"2024-08-05T10:39:57.969Z","updated_at":"2026-11-02T14:35:11.072321Z"}],"euvd":[{"id":"EUVD-2018-8736","description":"An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several RPC server routines did not fully initialize their output variables before returning, leaking memory contents from both the stack and the heap. Because the OpenAFS cache manager functions as an Rx server for the AFSCB service, clients are also susceptible to information leakage. For example, RXAFSCB_TellMeAboutYourself leaks kernel memory and KAM_ListEntry leaks kaserver memory.","status":"published","published":"2018-09-12T01:00:00Z","modified":"2024-08-05T10:39:57Z","updated_at":"2026-11-03T02:39:39.763591Z"}],"ghsa":[{"id":"GHSA-q586-r5vx-jgjf","title":"An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several RPC server...","description":"An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several RPC server routines did not fully initialize their output variables before returning, leaking memory contents from both the stack and the heap. Because the OpenAFS cache manager functions as an Rx server for the AFSCB service, clients are also susceptible to information leakage. For example, RXAFSCB_TellMeAboutYourself leaks kernel memory and KAM_ListEntry leaks kaserver memory.","status":"published","published":"2022-05-14T01:58:19Z","modified":"2023-02-02T05:05:05Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:52:01.503631Z"}],"nvd":[{"id":"CVE-2018-16948","description":"An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several RPC server routines did not fully initialize their output variables before returning, leaking memory contents from both the stack and the heap. Because the OpenAFS cache manager functions as an Rx server for the AFSCB service, clients are also susceptible to information leakage. For example, RXAFSCB_TellMeAboutYourself leaks kernel memory and KAM_ListEntry leaks kaserver memory.","status":"published","published":"2018-09-12T01:29:00.517Z","modified":"2026-06-17T01:45:06.417Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:04:38.672108Z"}],"osv":[{"id":"CVE-2018-16948","description":"An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several RPC server routines did not fully initialize their output variables before returning, leaking memory contents from both the stack and the heap. Because the OpenAFS cache manager functions as an Rx server for the AFSCB service, clients are also susceptible to information leakage. For example, RXAFSCB_TellMeAboutYourself leaks kernel memory and KAM_ListEntry leaks kaserver memory.","status":"published","published":"2018-09-12T01:29:00.517Z","modified":"2026-04-16T06:19:29.788897139Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:08.533609Z"},{"id":"DEBIAN-CVE-2018-16948","description":"An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several RPC server routines did not fully initialize their output variables before returning, leaking memory contents from both the stack and the heap. Because the OpenAFS cache manager functions as an Rx server for the AFSCB service, clients are also susceptible to information leakage. For example, RXAFSCB_TellMeAboutYourself leaks kernel memory and KAM_ListEntry leaks kaserver memory.","status":"published","published":"2018-09-12T01:29:00.517Z","modified":"2026-10-23T18:03:28.70426055Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:30.57382Z"},{"id":"UBUNTU-CVE-2018-16948","description":"An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several RPC server routines did not fully initialize their output variables before returning, leaking memory contents from both the stack and the heap. Because the OpenAFS cache manager functions as an Rx server for the AFSCB service, clients are also susceptible to information leakage. For example, RXAFSCB_TellMeAboutYourself leaks kernel memory and KAM_ListEntry leaks kaserver memory.","status":"published","published":"2018-09-12T01:29:00Z","modified":"2026-04-22T11:47:11.13306Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:17.496046Z"},{"id":"DLA-1513-1","title":"openafs - security update","status":"published","published":"2018-09-21T00:00:00Z","modified":"2026-03-09T01:19:22.984385Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-4302-1","title":"openafs - security update","status":"published","published":"2018-09-23T00:00:00Z","modified":"2026-03-09T02:10:12.724144Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2019-0021","title":"Updated openafs packages fix security vulnerabilities","description":"Jeffrey Altman reported that the backup tape controller (butc) process\ndoes accept incoming RPCs but does not require (or allow for)\nauthentication of those RPCs, allowing an unauthenticated attacker to\nperform volume operations with administrator credentials\n(CVE-2018-16947).\n\nMark Vitale reported that several RPC server routines do not fully\ninitialize output variables, leaking memory contents (from both the\nstack and the heap) to the remote caller for otherwise-successful RPCs\n(CVE-2018-16948).\n\nMark Vitale reported that an unauthenticated attacker can consume large\namounts of server memory and network bandwidth via specially crafted\nrequests, resulting in denial of service to legitimate clients\n(CVE-2018-16949).\n","status":"published","published":"2019-01-08T21:50:23Z","modified":"2026-04-16T06:25:47.436540473Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2024:11113-1","title":"openafs-1.8.8-1.13 on GA media","description":"These are all security issues fixed in the openafs-1.8.8-1.13 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:15:45.00846Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}