Read the docs
TI-2009-01185 Aliases CVE-2009-1250GHSA-cpqp-v482-xxhg

The cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58…

Priority MEDIUM 41CWE-189Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Complete
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-189 and the CVSS impact.

Summary

The cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58, and IBM AFS 3.6 before Patch 19, on Linux allows remote attackers to cause a denial of service (system crash) via an RX response with a large error-code value that is interpreted as a pointer and dereferenced, related to use of the ERR_PTR macro.

Why it matters now

EPSS 0.03976 90th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 79

CPEVersionsRoleVendor
cpe:2.3:a:ibm:afs:*:patch18:*:*:*:*:*:*up to 3.6VulnerableIBM
cpe:2.3:a:ibm:afs:3.6:*:*:*:*:*:*:*3.6VulnerableIBM
cpe:2.3:a:ibm:afs:3.6:patch12:*:*:*:*:*:*3.6 patch12VulnerableIBM
cpe:2.3:a:ibm:afs:3.6:patch13:*:*:*:*:*:*3.6 patch13VulnerableIBM
cpe:2.3:a:ibm:afs:3.6:patch14:*:*:*:*:*:*3.6 patch14VulnerableIBM
cpe:2.3:a:ibm:afs:3.6:patch15:*:*:*:*:*:*3.6 patch15VulnerableIBM
cpe:2.3:a:ibm:afs:3.6:patch16:*:*:*:*:*:*3.6 patch16VulnerableIBM
cpe:2.3:a:openafs:openafs:1.0:*:*:*:*:*:*:*1.0VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.0.1:*:*:*:*:*:*:*1.0.1VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.0.2:*:*:*:*:*:*:*1.0.2VulnerableThe OpenAFS Foundation
  • cpe:2.3:a:ibm:afs:*:patch18:*:*:*:*:*:* Versions up to 3.6 Vulnerable ·IBM
  • cpe:2.3:a:ibm:afs:3.6:*:*:*:*:*:*:* Versions 3.6 Vulnerable ·IBM
  • cpe:2.3:a:ibm:afs:3.6:patch12:*:*:*:*:*:* Versions 3.6 patch12 Vulnerable ·IBM
  • cpe:2.3:a:ibm:afs:3.6:patch13:*:*:*:*:*:* Versions 3.6 patch13 Vulnerable ·IBM
  • cpe:2.3:a:ibm:afs:3.6:patch14:*:*:*:*:*:* Versions 3.6 patch14 Vulnerable ·IBM
  • cpe:2.3:a:ibm:afs:3.6:patch15:*:*:*:*:*:* Versions 3.6 patch15 Vulnerable ·IBM
  • cpe:2.3:a:ibm:afs:3.6:patch16:*:*:*:*:*:* Versions 3.6 patch16 Vulnerable ·IBM
  • cpe:2.3:a:openafs:openafs:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·The OpenAFS Foundation
  • cpe:2.3:a:openafs:openafs:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·The OpenAFS Foundation
  • cpe:2.3:a:openafs:openafs:1.0.2:*:*:*:*:*:*:* Versions 1.0.2 Vulnerable ·The OpenAFS Foundation
Show 69 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:openafs:openafs:1.0.3:*:*:*:*:*:*:*1.0.3VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.0.4:*:*:*:*:*:*:*1.0.4VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.0.4a:*:*:*:*:*:*:*1.0.4aVulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.1:*:*:*:*:*:*:*1.1VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.1.0:*:*:*:*:*:*:*1.1.0VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.1.1:*:*:*:*:*:*:*1.1.1VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.1.1a:*:*:*:*:*:*:*1.1.1aVulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2:*:*:*:*:*:*:*1.2VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.1:*:*:*:*:*:*:*1.2.1VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.2:*:*:*:*:*:*:*1.2.2VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.2a:*:*:*:*:*:*:*1.2.2aVulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.2b:*:*:*:*:*:*:*1.2.2bVulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.3:*:*:*:*:*:*:*1.2.3VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.4:*:*:*:*:*:*:*1.2.4VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.5:*:*:*:*:*:*:*1.2.5VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.6:*:*:*:*:*:*:*1.2.6VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.7:*:*:*:*:*:*:*1.2.7VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.8:*:*:*:*:*:*:*1.2.8VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.9:*:*:*:*:*:*:*1.2.9VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.10:*:*:*:*:*:*:*1.2.10VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.11:*:*:*:*:*:*:*1.2.11VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.13:*:*:*:*:*:*:*1.2.13VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.3:*:*:*:*:*:*:*1.3VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.3.1:*:*:*:*:*:*:*1.3.1VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.3.2:*:*:*:*:*:*:*1.3.2VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.3.5:*:*:*:*:*:*:*1.3.5VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.3.70:*:*:*:*:*:*:*1.3.70VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.3.74:*:*:*:*:*:*:*1.3.74VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.3.77:*:*:*:*:*:*:*1.3.77VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.3.81:*:*:*:*:*:*:*1.3.81VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4:*:*:*:*:*:*:*1.4VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.0:*:*:*:*:*:*:*1.4.0VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.3:*:*:*:*:*:*:*1.4.3VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.4:*:*:*:*:*:*:*1.4.4VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.5:*:*:*:*:*:*:*1.4.5VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.6:*:*:*:*:*:*:*1.4.6VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.7:*:*:*:*:*:*:*1.4.7VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.7_pre1:*:*:*:*:*:*:*1.4.7_pre1VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.7_pre2:*:*:*:*:*:*:*1.4.7_pre2VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.7_pre3:*:*:*:*:*:*:*1.4.7_pre3VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.7_pre4:*:*:*:*:*:*:*1.4.7_pre4VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.7_pre5:*:*:*:*:*:*:*1.4.7_pre5VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.8:*:*:*:*:*:*:*1.4.8VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.8_pre1:*:*:*:*:*:*:*1.4.8_pre1VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.8_pre2:*:*:*:*:*:*:*1.4.8_pre2VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.8_pre3:*:*:*:*:*:*:*1.4.8_pre3VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5:*:*:*:*:*:*:*1.5VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.16:*:*:*:*:*:*:*1.5.16VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.17:*:*:*:*:*:*:*1.5.17VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.26:*:*:*:*:*:*:*1.5.26VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.27:*:*:*:*:*:*:*1.5.27VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.30:*:*:*:*:*:*:*1.5.30VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.31:*:*:*:*:*:*:*1.5.31VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.32:*:*:*:*:*:*:*1.5.32VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.33:*:*:*:*:*:*:*1.5.33VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.34:*:*:*:*:*:*:*1.5.34VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.35:*:*:*:*:*:*:*1.5.35VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.36:*:*:*:*:*:*:*1.5.36VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.38:*:*:*:*:*:*:*1.5.38VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.39:*:*:*:*:*:*:*1.5.39VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.50:*:*:*:*:*:*:*1.5.50VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.52:*:*:*:*:*:*:*1.5.52VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.53:*:*:*:*:*:*:*1.5.53VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.54:*:*:*:*:*:*:*1.5.54VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.55:*:*:*:*:*:*:*1.5.55VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.56:*:*:*:*:*:*:*1.5.56VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.57:*:*:*:*:*:*:*1.5.57VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.5.58:*:*:*:*:*:*:*1.5.58VulnerableThe OpenAFS Foundation
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*all versionsRunning onLinux

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-1250
  2. 2026-10-03 Alias added: GHSA-cpqp-v482-xxhg

References

Exploit 1

Advisory 4

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences