CVE-2024-10394

What it actually does

The vulnerability permits a local user to circumvent the Process Authentication Group (PAG) throttling mechanism in OpenAFS Unix clients, enabling the creation of a PAG with an existing identifier to join and extract credentials from that PAG.

Why it matters to the business

Attackers with local access can steal authentication credentials for OpenAFS, leading to unauthorized access to distributed file system resources and potential data breaches.

How an attack unfolds

An attacker with local access on a Unix system identifies an existing PAG ID used by another process, bypasses the throttling to create a new PAG with that ID, joins it, and thereby gains access to the credentials stored in the PAG.

How to fix it

Update OpenAFS client to a version that enforces proper PAG ID uniqueness and throttling. Monitor for local privilege escalations or unusual PAG creations.

How to confirm the fix worked

Verify that PAG creation rejects duplicate IDs and test throttling enforcement after applying updates.

Typical attack path

1. Obtain local access to Unix system running OpenAFS client
2. Identify target PAG ID
3. Exploit throttling bypass to create PAG with existing ID
4. Join the PAG to inherit credentials
5. Use stolen credentials for unauthorized AFS operations

How to detect it

Review system logs for unusual PAG creation attempts or duplicate ID usage in OpenAFS client processes. Monitor for processes accessing AFS tokens unexpectedly.

What your security team should do

• Apply latest OpenAFS patches immediately
• Restrict local user access where possible
• Audit AFS credential usage for anomalies
• Implement additional monitoring on Unix clients