9.8

CVE-2024-10934

OpenBSD NFS double-free vulnerability

In OpenBSD 7.5 before errata 008 and OpenBSD 7.4 before errata 021, 
avoid possible mbuf double free in NFS client and server implementation, do not use uninitialized variable in error handling of NFS server.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Openbsd ≫ Openbsd Version < 7.4
Openbsd ≫ Openbsd Version 7.4 Update -
Openbsd ≫ Openbsd Version 7.4 Update errata_001
Openbsd ≫ Openbsd Version 7.4 Update errata_002
Openbsd ≫ Openbsd Version 7.4 Update errata_003
Openbsd ≫ Openbsd Version 7.4 Update errata_004
Openbsd ≫ Openbsd Version 7.4 Update errata_005
Openbsd ≫ Openbsd Version 7.4 Update errata_006
Openbsd ≫ Openbsd Version 7.4 Update errata_007
Openbsd ≫ Openbsd Version 7.4 Update errata_008
Openbsd ≫ Openbsd Version 7.4 Update errata_009
Openbsd ≫ Openbsd Version 7.4 Update errata_010
Openbsd ≫ Openbsd Version 7.4 Update errata_011
Openbsd ≫ Openbsd Version 7.4 Update errata_012
Openbsd ≫ Openbsd Version 7.4 Update errata_013
Openbsd ≫ Openbsd Version 7.4 Update errata_014
Openbsd ≫ Openbsd Version 7.4 Update errata_015
Openbsd ≫ Openbsd Version 7.4 Update errata_016
Openbsd ≫ Openbsd Version 7.4 Update errata_017
Openbsd ≫ Openbsd Version 7.4 Update errata_018
Openbsd ≫ Openbsd Version 7.4 Update errata_019
Openbsd ≫ Openbsd Version 7.4 Update errata_020
Openbsd ≫ Openbsd Version 7.5 Update -
Openbsd ≫ Openbsd Version 7.5 Update errata_001
Openbsd ≫ Openbsd Version 7.5 Update errata_002
Openbsd ≫ Openbsd Version 7.5 Update errata_003
Openbsd ≫ Openbsd Version 7.5 Update errata_004
Openbsd ≫ Openbsd Version 7.5 Update errata_005
Openbsd ≫ Openbsd Version 7.5 Update errata_006
Openbsd ≫ Openbsd Version 7.5 Update errata_007
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.42% 0.337
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
cisa-cg 9.2 0 0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X
cisa-cg 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-415 Double Free

The product calls free() twice on the same memory address.

CWE-457 Use of Uninitialized Variable

The code uses a variable that has not been initialized, leading to unpredictable or unintended results.

https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/common/021_nfs.patch.sig
Patch
https://ftp.openbsd.org/pub/OpenBSD/patches/7.5/common/008_nfs.patch.sig
Patch