CVE-2024-10396CWE-772

Fileserver crash and possible information leak on StoreACL/FetchACL

Medium · published November 14, 2024

CVSS v3.1
6.5
EPSS
1%
Percentile
45.8
In the wild
Unconfirmed
What it is

An authenticated user can provide a malformed ACL to the fileserver's StoreACL RPC, causing the fileserver to crash, possibly expose uninitialized memory, and possibly store garbage data in the audit log. Malformed ACLs provided in responses to client FetchACL RPCs can cause client processes to crash and possibly expose uninitialized memory into other ACLs stored on the server.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00559 · 45.8th percentile
Weakness
CWE-772 · Missing Release of Resource after Effective Lifetime
Published
2024-11-14T19:30Z
EPSS history
Timeline
  • 14 NOV 19:30Z
    Fileserver crash and possible information leak on StoreACL/FetchACL
    cvelistv5