Read the docs
TI-2024-10135 Aliases CVE-2024-10934GHSA-cx22-p4ff-962q

OpenBSD NFS double-free vulnerability

Priority MEDIUM 48CWE-415Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-415 and the CVSS impact.

Summary

In OpenBSD 7.5 before errata 008 and OpenBSD 7.4 before errata 021, avoid possible mbuf double free in NFS client and server implementation, do not use uninitialized variable in error handling of NFS server.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00436 38th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenBSDOpenBSD7.5; 7.4—No fix listedCNA
  • OpenBSD VendorOpenBSD Affected 7.5; 7.4 Fixed in — No fix listed CNA

CPE configurations NVD · 30

CPEVersionsRoleVendor
cpe:2.3:o:openbsd:openbsd:*:*:*:*:*:*:*:*before 7.4VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:-:*:*:*:*:*:*7.4VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_001:*:*:*:*:*:*7.4 errata_001VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_002:*:*:*:*:*:*7.4 errata_002VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_003:*:*:*:*:*:*7.4 errata_003VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_004:*:*:*:*:*:*7.4 errata_004VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_005:*:*:*:*:*:*7.4 errata_005VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_006:*:*:*:*:*:*7.4 errata_006VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_007:*:*:*:*:*:*7.4 errata_007VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_008:*:*:*:*:*:*7.4 errata_008VulnerableOpenBSD
  • cpe:2.3:o:openbsd:openbsd:*:*:*:*:*:*:*:* Versions before 7.4 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:-:*:*:*:*:*:* Versions 7.4 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_001:*:*:*:*:*:* Versions 7.4 errata_001 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_002:*:*:*:*:*:* Versions 7.4 errata_002 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_003:*:*:*:*:*:* Versions 7.4 errata_003 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_004:*:*:*:*:*:* Versions 7.4 errata_004 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_005:*:*:*:*:*:* Versions 7.4 errata_005 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_006:*:*:*:*:*:* Versions 7.4 errata_006 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_007:*:*:*:*:*:* Versions 7.4 errata_007 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_008:*:*:*:*:*:* Versions 7.4 errata_008 Vulnerable ·OpenBSD
Show 20 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:openbsd:openbsd:7.4:errata_009:*:*:*:*:*:*7.4 errata_009VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_010:*:*:*:*:*:*7.4 errata_010VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_011:*:*:*:*:*:*7.4 errata_011VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_012:*:*:*:*:*:*7.4 errata_012VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_013:*:*:*:*:*:*7.4 errata_013VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_014:*:*:*:*:*:*7.4 errata_014VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_015:*:*:*:*:*:*7.4 errata_015VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_016:*:*:*:*:*:*7.4 errata_016VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_017:*:*:*:*:*:*7.4 errata_017VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_018:*:*:*:*:*:*7.4 errata_018VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_019:*:*:*:*:*:*7.4 errata_019VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_020:*:*:*:*:*:*7.4 errata_020VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.5:-:*:*:*:*:*:*7.5VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.5:errata_001:*:*:*:*:*:*7.5 errata_001VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.5:errata_002:*:*:*:*:*:*7.5 errata_002VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.5:errata_003:*:*:*:*:*:*7.5 errata_003VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.5:errata_004:*:*:*:*:*:*7.5 errata_004VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.5:errata_005:*:*:*:*:*:*7.5 errata_005VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.5:errata_006:*:*:*:*:*:*7.5 errata_006VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.5:errata_007:*:*:*:*:*:*7.5 errata_007VulnerableOpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_009:*:*:*:*:*:* Versions 7.4 errata_009 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_010:*:*:*:*:*:* Versions 7.4 errata_010 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_011:*:*:*:*:*:* Versions 7.4 errata_011 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_012:*:*:*:*:*:* Versions 7.4 errata_012 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_013:*:*:*:*:*:* Versions 7.4 errata_013 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_014:*:*:*:*:*:* Versions 7.4 errata_014 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_015:*:*:*:*:*:* Versions 7.4 errata_015 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_016:*:*:*:*:*:* Versions 7.4 errata_016 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_017:*:*:*:*:*:* Versions 7.4 errata_017 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_018:*:*:*:*:*:* Versions 7.4 errata_018 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_019:*:*:*:*:*:* Versions 7.4 errata_019 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_020:*:*:*:*:*:* Versions 7.4 errata_020 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.5:-:*:*:*:*:*:* Versions 7.5 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.5:errata_001:*:*:*:*:*:* Versions 7.5 errata_001 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.5:errata_002:*:*:*:*:*:* Versions 7.5 errata_002 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.5:errata_003:*:*:*:*:*:* Versions 7.5 errata_003 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.5:errata_004:*:*:*:*:*:* Versions 7.5 errata_004 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.5:errata_005:*:*:*:*:*:* Versions 7.5 errata_005 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.5:errata_006:*:*:*:*:*:* Versions 7.5 errata_006 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.5:errata_007:*:*:*:*:*:* Versions 7.5 errata_007 Vulnerable ·OpenBSD

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-10934
  2. 2026-10-03 Alias added: GHSA-cx22-p4ff-962q

References

Patch 2

  • TI-2002-00376 Integer overflow in xdr_array function in RPC servers for operating systems that use… CVSS 3.1CRITICAL 9.8
  • TI-2003-00437 Off-by-one error in the fb_realpath() function, as derived from the realpath function in… CVSS 3.1CRITICAL 9.8
  • TI-2007-05153 Stack-based buffer overflow in the cons_options function in options.c in dhcpd in OpenBSD… CVSS 2.0HIGH 7.2
  • TI-2001-00539 Buffer overflow in BSD-based telnetd telnet daemon on various operating systems allows… CVSS 2.0HIGH 10.0
  • TI-2026-40218 sppp_pap_input in sys/net/if_spppsubr.c in OpenBSD before 076e2b1 allows authentication… CVSS 3.1HIGH 8.3
  • TI-2004-00444 Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31… CVSS 2.0HIGH 10.0
See all 200 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences