Skip to content
CVE PROGRAM SOURCE RECORD8.4 High

CVE-2024-10394

Theft of credentials in Unix client PAGs

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
fedora

Description

A local user can bypass the OpenAFS PAG (Process Authentication Group) throttling mechanism in Unix clients, allowing the user to create a PAG using an existing id number, effectively joining the PAG and letting the user steal the credentials in that PAG.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

The OpenAFS Foundation OpenAFS

Default version status: unaffected

  • 1.0 to < 1.6.24affected
  • 1.8.0 to < 1.8.12.2affected
  • 1.9.0 to < 1.9.1affected

References