PT-2024-19679 · Bpftrace+5 · Bpftrace+5

Brendan Gregg + 3 · Published 2024-03-10 · Updated 2025-03-17 · CVE-2024-2313

Positive Technologies (AI Summary)

CVSS v3.1

2.8

Low

Base vector

AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions bpftrace (affected versions not specified)

Description The issue allows an unprivileged attacker to force bcc to load compromised Linux headers if kernel headers need to be extracted and are not provided by default. This can occur because bpftrace attempts to load the headers from a temporary directory. Linux distributions that provide kernel headers by default are not affected.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-377

Related Identifiers

ALSA-2024:8830

ALSA-2024:9188

AZL-35836

AZL-35874

CESA-2024_8830

CVE-2024-2313

INFSA-2024_8830

INFSA-2024_9188

OPENSUSE-SU-2024:13986-1

RHSA-2024:8830

RHSA-2024:9188

RHSA-2024_8830

RHSA-2024_9188

RLSA-2024:8830

RLSA-2024:9188

Affected Products

Almalinux

Centos

Debian

Red Hat

Rocky Linux

Bpftrace

References · 25

• https://github.com/bpftrace/bpftrace/commit/4be4b7191acb8218240e6b7178c30fa8c9b59998 · Patch
• https://errata.rockylinux.org/RLSA-2024:8830 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2024:9188 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-2313 · Security Note
• https://errata.almalinux.org/8/ALSA-2024-8830.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2024-8830.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-2313 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2024:9188 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-2313 · Security Note
• https://linux.oracle.com/errata/ELSA-2024-9188.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-2313 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-2313 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2024:8830 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2024-9188.html · Vendor Advisory
• https://osv.dev/vulnerability/AZL-35874 · Vendor Advisory