An authenticated user can provide a malformed ACL to the fileserver's StoreACL RPC, causing the fileserver to crash, possibly expose uninitialized memory, and possibly store garbage data in the audit log. Malformed ACLs provided in responses to client FetchACL RPCs can cause client processes to crash and possibly expose uninitialized memory into other ACLs stored on the server.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Openafs
  • Openafs

Configuration 1 [-]

OR cpe:2.3:a:openafs:openafs:*:*:*:*:*:*:*:*
cpe:2.3:a:openafs:openafs:*:*:*:*:*:*:*:*
cpe:2.3:a:openafs:openafs:1.9.0:*:*:*:*:*:*:*

No data.

References
Link Providers
https://lists.debian.org/debian-lts-announce/2025/05/msg00019.html cve-icon
https://openafs.org/pages/security/OPENAFS-SA-2024-002.txt cve-icon cve-icon
History

Mon, 03 Nov 2025 20:30:00 +0000

Type Values Removed Values Added
References

Wed, 06 Aug 2025 20:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:openafs:openafs:*:*:*:*:*:*:*:*
cpe:2.3:a:openafs:openafs:1.9.0:*:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Fri, 11 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00214}

 epss

{'score': 0.00178}

Fri, 22 Nov 2024 12:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 0.0, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N'}

Tue, 19 Nov 2024 16:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 0, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 14 Nov 2024 19:45:00 +0000

Type Values Removed Values Added
Description An authenticated user can provide a malformed ACL to the fileserver's StoreACL RPC, causing the fileserver to crash, possibly expose uninitialized memory, and possibly store garbage data in the audit log. Malformed ACLs provided in responses to client FetchACL RPCs can cause client processes to crash and possibly expose uninitialized memory into other ACLs stored on the server.
Title An authenticated user can provide a malformed ACL to the fileserver's StoreACL RPC, causing the fileserver to crash
Weaknesses CWE-1286
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: fedora

Published: 2024-11-14T19:30:53.832Z

Updated: 2025-11-03T19:29:09.042Z

Reserved: 2024-10-25T19:25:45.524Z

Link: CVE-2024-10396

cve-icon Vulnrichment

Updated: 2025-11-03T19:29:09.042Z

cve-icon NVD

Status : Modified

Published: 2024-11-14T20:15:20.917

Modified: 2025-11-03T20:16:07.830

Link: CVE-2024-10396

cve-icon Redhat

No data.