{"id":"CVE-2024-10934","state":"PUBLISHED","title":"OpenBSD NFS double-free vulnerability","description":"In OpenBSD 7.5 before errata 008 and OpenBSD 7.4 before errata 021, \navoid possible mbuf double free in NFS client and server implementation, do not use uninitialized variable in error handling of NFS server.","publishedAt":"2024-11-15T19:20:02.231Z","updatedAt":"2025-10-02T14:09:00.828Z","severity":{"score":9.2,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y","source":"cisa-cg"},"assigner":"cisa-cg","products":["OpenBSD OpenBSD"],"affected":[{"vendor":"OpenBSD","product":"OpenBSD","defaultStatus":"unknown","versions":[{"version":"7.5","status":"affected"},{"version":"7.4","status":"affected"}]}],"references":["https://ftp.openbsd.org/pub/OpenBSD/patches/7.5/common/008_nfs.patch.sig","https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/common/021_nfs.patch.sig"],"weaknesses":["CWE-415","CWE-457"],"ingestedAt":"2026-10-29T20:06:50.777Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/10xxx/CVE-2024-10934.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-10934","state":"PUBLISHED","datePublished":"2024-11-15T19:20:02.231Z","dateUpdated":"2025-10-02T14:09:00.828Z","assignerShortName":"cisa-cg","assignerOrgId":"9119a7d8-5eab-497f-8521-727c672e3725","dateReserved":"2024-11-06T18:12:18.387Z"},"containers":{"cna":{"title":"OpenBSD NFS double-free vulnerability","descriptions":[{"lang":"en","value":"In OpenBSD 7.5 before errata 008 and OpenBSD 7.4 before errata 021, \navoid possible mbuf double free in NFS client and server implementation, do not use uninitialized variable in error handling of NFS server."}],"affected":[{"vendor":"OpenBSD","product":"OpenBSD","defaultStatus":"unknown","versions":[{"version":"7.5","status":"affected"},{"version":"7.4","status":"affected"}]}],"references":[{"url":"https://ftp.openbsd.org/pub/OpenBSD/patches/7.5/common/008_nfs.patch.sig","name":"url"},{"url":"https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/common/021_nfs.patch.sig","name":"url"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}},{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":9.2,"baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-415","description":"CWE-415 Double Free","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-457","description":"CWE-457 Use of Uninitialized Variable","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"cisa-cg","orgId":"9119a7d8-5eab-497f-8521-727c672e3725","dateUpdated":"2025-10-02T14:09:00.828Z"},"datePublic":"2024-11-15T00:00:00.000Z"},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"openbsd","product":"openbsd","defaultStatus":"unknown","versions":[{"version":"7.5","status":"affected","lessThan":"7.5_errata_008","versionType":"custom"},{"version":"7.4","status":"affected","lessThan":"7.4_errata_021","versionType":"custom"}],"cpes":["cpe:2.3:o:openbsd:openbsd:*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-11-15T19:46:59.490027Z","id":"CVE-2024-10934","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-11-15T19:47:11.376Z"}}]}}}