CVE-2024-10396: Fileserver crash and possible information leak on StoreACL/FetchACL
An authenticated user can provide a malformed ACL to the fileserver's StoreACL RPC, causing the fileserver to crash, possibly expose uninitialized memory, and possibly store garbage data in the audit log. Malformed ACLs provided in responses to client FetchACL RPCs can cause client processes to crash and possibly expose uninitialized memory into other ACLs stored on the server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10396?
CVE-2024-10396 is considered a high severity vulnerability due to its potential to crash the fileserver and expose uninitialized memory.
How do I fix CVE-2024-10396?
To fix CVE-2024-10396, update your OpenAFS installation to the latest version that addresses this vulnerability.
What versions of OpenAFS are affected by CVE-2024-10396?
CVE-2024-10396 affects OpenAFS versions from 1.0 to 1.6.25 and from 1.8.0 to 1.8.13, as well as exactly 1.9.0.
Can CVE-2024-10396 lead to data exposure?
Yes, CVE-2024-10396 may lead to exposure of uninitialized memory and the possibility of storing garbage data in the audit log.
Who is at risk with CVE-2024-10396?
Authenticated users of OpenAFS versions affected by CVE-2024-10396 are at risk as they can exploit the vulnerability by providing malformed ACLs.