What’s Vulnerable › Vulnerabilities

CVE-2024-10396: Fileserver crash and possible information leak on StoreACL/FetchACL

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-11-14 · updated 2026-06-17
• Weakness: CWE-772

Description

An authenticated user can provide a malformed ACL to the fileserver's StoreACL RPC, causing the fileserver to crash, possibly expose uninitialized memory, and possibly store garbage data in the audit log. Malformed ACLs provided in responses to client FetchACL RPCs can cause client processes to crash and possibly expose uninitialized memory into other ACLs stored on the server.

Affected products

• The OpenAFS Foundation OpenAFS: from 1.0 before 1.6.25; from 1.8.0 before 1.8.13; 1.9.0 — fixed in 1.6.25, 1.8.13

How to fix

Upgrade to a fixed version: The OpenAFS Foundation OpenAFS 1.6.25, 1.8.13. Check the vendor advisory for mitigations.

References

• https://www.openafs.org/pages/security/OPENAFS-SA-2024-002.txt
• https://www.openafs.org/security
• https://lists.debian.org/debian-lts-announce/2025/05/msg00019.html

Get alerted when CVE-2024-10396 or the next vulnerability affects your stack