CVE-2024-10397

What it actually does

A malicious OpenAFS server can trigger crashes in the cache manager and client utilities or achieve remote code execution on connecting clients through crafted protocol responses.

Why it matters to the business

Legacy Ubuntu systems using OpenAFS face risk of service disruption or full system compromise if clients connect to attacker-controlled servers, increasing exposure on unpatched environments.

How an attack unfolds

An attacker hosts a malicious OpenAFS server and induces a vulnerable client to connect; the server then sends specially crafted responses that corrupt memory in the cache manager, leading to a crash or arbitrary code execution.

How to fix it

Upgrade affected packages to the listed fixed versions: linux (Ubuntu 14.04 LTS) to 3.13.0-73.116, linux-aws (Ubuntu 14.04 LTS) to 4.4.0-1002.2, linux-lts-xenial (Ubuntu 14.04 LTS) to 4.4.0-13.29~14.04.1, linux (Ubuntu 16.04 LTS) to 4.3.0-1.10, linux-aws (Ubuntu 16.04 LTS) to 4.4.0-1001.10, linux-gke (Ubuntu 16.04 LTS) to 4.4.0-1003.3, linux-hwe (Ubuntu 16.04 LTS) to 4.8.0-36.36~16.04.1, linux-snapdragon (Ubuntu 16.04 LTS) to 4.4.0-1012.12, linux-lts-utopic (Ubuntu 14.04 LTS) to 3.16.0-56.75~14.04.1, linux-lts-vivid (Ubuntu 14.04 LTS) to 3.19.0-41.46~14.04.2, linux-lts-wily (Ubuntu 14.04 LTS) to 4.2.0-21.25~14.04.1. Remove or isolate OpenAFS clients on unsupported releases.

How to confirm the fix worked

Verify installed kernel and OpenAFS package versions match or exceed the fixed releases; attempt connection to a test OpenAFS server and monitor for crashes in afsd or related utilities.

Typical attack path

1. Deploy a malicious OpenAFS server under attacker control
2. Trick or redirect a vulnerable client to connect to the malicious server
3. Server delivers crafted AFS protocol responses during cache operations
4. Client cache manager processes malformed data resulting in memory corruption
5. Crash occurs or attacker-supplied code executes on the client

How to detect it

Review system logs for unexpected OpenAFS cache manager crashes or segmentation faults around client connection times; inspect network traffic for connections to untrusted AFS servers.

What your security team should do

• Immediately identify and patch all listed Ubuntu releases to the provided fixed kernel versions
• Disable or restrict OpenAFS client usage on legacy systems until upgraded
• Monitor for new EPSS increases or exploit maturity changes given the RCE classification