{"id":"CVE-2024-10394","summary":"Theft of credentials in Unix client PAGs","details":"A local user can bypass the OpenAFS PAG (Process Authentication Group) throttling mechanism in Unix clients, allowing the user to create a PAG using an existing id number, effectively joining the PAG and letting the user steal the credentials in that PAG.","modified":"2026-08-12T03:51:08.099365368Z","published":"2024-11-14T19:07:50.492Z","database_specific":{"cwe_ids":["CWE-305"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/10xxx/CVE-2024-10394.json","cna_assigner":"fedora"},"references":[{"type":"WEB","url":"https://github.com/openafs/openafs/"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00019.html"},{"type":"WEB","url":"https://www.openafs.org/pages/security/OPENAFS-SA-2024-001.txt"},{"type":"WEB","url":"https://www.openafs.org/security"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/10xxx/CVE-2024-10394.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10394"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openafs/openafs","events":[{"introduced":"87c10e8d7f05dbbdf12ee9e8651dcec07e08af3f"},{"fixed":"418214d1db7b52575afd6a8c478ca4968ba3ba05"},{"introduced":"a08327fe2e74269d26eef1cddd7c9f9b7efa96e2"},{"fixed":"04c4bd974e519cec15e9a7aece1feab11eee31c5"},{"introduced":"0a7d0c30a940dbbafe3f97fa222750d95870df93"},{"fixed":"2ab21bd6c0bbcc0e663c3b8b9521724316f0a611"}],"database_specific":{"extracted_events":[{"introduced":"1.0"},{"fixed":"1.6.24"},{"introduced":"1.8.0"},{"fixed":"1.8.12.2"},{"introduced":"1.9.0"},{"fixed":"1.9.1"}],"source":"AFFECTED_FIELD"}}],"versions":["openafs-stable-1_8_12_1","openafs-stable-1_8_12","openafs-stable-1_8_12pre1","openafs-stable-1_8_11","openafs-stable-1_8_11pre1","openafs-stable-1_8_10","openafs-stable-1_8_10pre1","openafs-stable-1_8_9","openafs-stable-1_8_9pre2","openafs-stable-1_8_9pre1","openafs-stable-1_8_8_1","openafs-stable-1_8_8","openafs-stable-1_8_8pre2","openafs-stable-1_8_8pre1","openafs-stable-1_8_6","openafs-devel-1_9_0","openafs-stable-1_8_6pre3","openafs-stable-1_8_6pre2","openafs-stable-1_8_6pre1","openafs-stable-1_8_5","openafs-stable-1_6_23","openafs-stable-1_8_4","openafs-stable-1_8_4pre2","openafs-stable-1_8_4pre1","openafs-stable-1_8_3","openafs-stable-1_8_3pre1","openafs-stable-1_8_2","openafs-stable-1_6_22_4","openafs-stable-1_8_1_1","openafs-stable-1_6_22_3","openafs-stable-1_8_1","openafs-stable-1_8_1pre2","openafs-stable-1_8_1pre1","openafs-stable-1_6_22_2","openafs-stable-1_8_0","openafs-stable-1_6_22_1","openafs-stable-1_6_22","openafs-stable-1_6_21_1","openafs-stable-1_6_21","openafs-stable-1_6_21pre1","openafs-stable-1_6_20_2","openafs-stable-1_6_20_1","openafs-stable-1_6_20","openafs-stable-1_6_19","openafs-stable-1_6_19pre1","openafs-stable-1_6_18_3","openafs-stable-1_6_18_2","openafs-stable-1_6_18_1","openafs-stable-1_6_18","openafs-stable-1_6_18pre1","openafs-stable-1_6_17","openafs-stable-1_6_16","openafs-stable-1_6_16pre1","openafs_stable_1_6_14_1","openafs-stable-1_6_14_1","openafs-stable-1_6_14","openafs-stable-1_6_13","openafs-stable-1_6_12","openafs-stable-1_6_12pre2","openafs-stable-1_6_11_1","openafs-stable-1_6_12pre1","openafs-stable-1_6_11","openafs-stable-1_6_11pre2","openafs-stable-1_6_11pre1","openafs-stable-1_6_10","openafs-stable-1_6_10pre1","openafs-stable-1_6_8","openafs-stable-1_6_8pre2","openafs-stable-1_6_8pre1","openafs-stable-1_6_6","openafs-stable-1_6_6pre2","openafs-stable-1_6_6pre1","openafs-stable-1_6_4","openafs-stable-1_6_3","openafs-stable-1_6_3pre3","openafs-stable-1_6_3pre2","openafs-stable-1_6_2_1","openafs-stable-1_6_2","openafs-stable-1_6_2pre3","openafs-stable-1_6_2pre2","openafs-stable-1_6_2pre1","openafs-stable-1_6_1pre2","openafs-stable-1_6_1pre1","openafs-devel-1_7_24","openafs-stable-1_6_0b","openafs-stable-1_6_0","openafs-stable-1_6_0a","openafs-stable-1_6_0pre7","openafs-stable-1_6_0pre6","openafs-stable-1_6_0pre5","openafs-stable-1_6_0pre4","openafs-stable-1_6_0pre3","openafs-stable-1_6_0pre2","openafs-stable-1_6_0pre1","openafs-devel-1_5_78","openafs-devel-1_5_77","openafs-devel-1_5_76","openafs-devel-1_5_75","openafs-devel-1_5_74_1","openafs-devel-1_5_74","openafs-devel-1_5_73_3","openafs-devel-1_5_73_2","openafs-devel-1_5_73_1","openafs-devel-1_5_73","openafs-devel-1_5_72","openafs-devel-1_5_71","openafs-devel-1_5_70","openafs-devel-1_5_69","openafs-devel-1_5_68","openafs-devel-1_5_67","openafs-devel-1_5_66","openafs-devel-1_5_65","openafs-devel-1_5_64","openafs-devel-1_5_63","openafs-devel-1_5_62","openafs-devel-1_5_61","BP-openafs-windows-kdfs-ifs","BP-openafs-devel-1_5_x","mp-rxtcp-20060505","openafs-devel-1_5_1","mp-rxtcp-20060314","openafs-devel-1_5_0","BP-disconnected","BP-openafs-stable-1_4_x","openafs-devel-1_3_66","openafs-devel-1_3_65","openafs-devel-1_3_64","openafs-devel-1_3_63","openafs-devel-1_3_62","openafs-devel-1_3_61","openafs-devel-1_3_60","openafs-devel-1_3_51","openafs-devel-1_3_50","openafs-rxkad-krb5-minimal","BP-openafs-rxkad-krb5","openafs-devel_1_3_3","openafs-devel-1_3_1","openafs-devel-1_3_0","BP-openafs-stable-1_2_x","BP-openafs-devel-autoconf","openafs-stable-1_0_1","BP-openafs-stable-1_0_x","openafs-devel-license-update","openafs-root","openafs-ibm-1_0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-10394.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}]}