CVE-2018-16948: Infoleak
An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several RPC server routines did not fully initialize their output variables before returning, leaking memory contents from both the stack and the heap. Because the OpenAFS cache manager functions as an Rx server for the AFSCB service, clients are also susceptible to information leakage. For example, RXAFSCBTellMeAboutYourself leaks kernel memory and KAMListEntry leaks kaserver memory.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-16948?
CVE-2018-16948 has a medium severity level due to its potential to leak sensitive memory information.
How do I fix CVE-2018-16948?
To fix CVE-2018-16948, update OpenAFS to version 1.6.23 or 1.8.2 and later releases.
What systems are affected by CVE-2018-16948?
CVE-2018-16948 affects OpenAFS versions prior to 1.6.23 and versions within the 1.8.x series before 1.8.2, as well as Debian Linux 8.0 and 9.0.
What type of vulnerability is CVE-2018-16948?
CVE-2018-16948 is a memory leak vulnerability caused by insufficient initialization of output variables in several RPC server routines.
Can CVE-2018-16948 be exploited remotely?
Yes, CVE-2018-16948 can potentially be exploited remotely through the OpenAFS cache manager's RPC communications.