PT-2024-8247 · Openbsd · Openbsd

Published 2024-11-15 · Updated 2025-10-02 · CVE-2024-10934

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: OpenBSD versions 7.4 through 7.5 before errata 008 and 021

Description: The issue is related to a possible mbuf double free in the NFS client and server implementation, as well as the use of an uninitialized variable in error handling of the NFS server. This could allow a remote attacker to impact the confidentiality, integrity, and availability of the system.

Recommendations: For OpenBSD versions 7.4 and 7.5, apply the respective errata updates, specifically errata 021 for version 7.4 and errata 008 for version 7.5, to fix the mbuf double free and uninitialized variable issues in the NFS client and server implementations. As a temporary workaround, consider restricting access to the NFS client and server until the updates are applied.

Fix

RCE

Double Free

Weakness Enumeration

CWE-457

CWE-415

Related Identifiers

BDU:2024-09800

CVE-2024-10934

Affected Products

Openbsd

References · 13

• https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/common/021_nfs.patch.sig · Patch
• https://bdu.fstec.ru/vul/2024-09800 · Security Note
• https://ftp.openbsd.org/pub/OpenBSD/patches/7.5/common/008_nfs.patch.sig · Patch
• https://osv.dev/vulnerability/CVE-2024-10934 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10934 · Security Note
• https://twitter.com/oktsec/status/1857538515103334639 · Twitter Post
• https://twitter.com/vuldb/status/1857542727933808989 · Twitter Post
• https://twitter.com/CveFindCom/status/1857506724875206789 · Twitter Post
• https://t.me/cvedetector/11180 · Telegram Post
• https://twitter.com/0dayPublishing/status/1973755809013113232 · Twitter Post
• https://t.me/cveNotify/134336 · Telegram Post
• https://t.me/cveNotify/137195 · Telegram Post
• https://twitter.com/CVEnew/status/1857557128229319085 · Twitter Post