CVE-2024-10394
published 2024-11-14CVE-2024-10394: A local user can bypass the OpenAFS PAG (Process Authentication Group) throttling mechanism in Unix clients, allowing the user to create a PAG using an…
high8.4CVSS 4.0
AVLACLATNPRNUIPVCHVIHVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
A local user can bypass the OpenAFS PAG (Process Authentication Group) throttling mechanism in Unix clients, allowing the user to create a PAG using an existing id number, effectively joining the PAG and letting the user steal the credentials in that PAG.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | openafs | < openafs 1.8.9-1+deb12u1 (bookworm) | openafs 1.8.9-1+deb12u1 (bookworm) |
| openafs | openafs | — | — |
| openafs | openafs | >= 0 < 1.8.6-5+deb11u1 | 1.8.6-5+deb11u1 |
| openafs | openafs | >= 0 < 1.8.9-1+deb12u1 | 1.8.9-1+deb12u1 |
| openafs | openafs | >= 0 < 1.8.13-1 | 1.8.13-1 |
| openafs | openafs | >= 1.0 < 1.6.25 | 1.6.25 |
| openafs | openafs | >= 1.8.0 < 1.8.13 | 1.8.13 |
| the_openafs_foundation | openafs | >= 1.0 < 1.6.24 | 1.6.24 |
| the_openafs_foundation | openafs | >= 1.8.0 < 1.8.12.2 | 1.8.12.2 |
| the_openafs_foundation | openafs | >= 1.9.0 < 1.9.1 | 1.9.1 |
CVSS provenance
nvdv4.08.4HIGHCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv8.4HIGH