PT-2024-19690 · Bcc+5 · Bcc+5

Brendan Gregg + 2 · Published 2024-03-10 · Updated 2025-08-26 · CVE-2024-2314

Positive Technologies (AI Summary)

CVSS v3.1

2.8

Low

Base vector

AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions bcc (affected versions not specified)

Description The issue arises when kernel headers need to be extracted, and bcc attempts to load them from a temporary directory. An unprivileged attacker could exploit this to force bcc to load compromised Linux headers. However, Linux distributions that provide kernel headers by default are not affected by default.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

ALSA-2024:8831

ALSA-2024:9187

AZL-38914

CESA-2024_8831

CVE-2024-2314

INFSA-2024_8831

INFSA-2024_9187

OESA-2024-2502

RHSA-2024:8831

RHSA-2024:9187

RHSA-2024_8831

RHSA-2024_9187

RLSA-2024:8831

Affected Products

Almalinux

Centos

Debian

Red Hat

Rocky Linux

Bcc

References · 27

• https://github.com/iovisor/bcc/commit/008ea09e891194c072f2a9305a3c872a241dc342 · Patch
• https://errata.rockylinux.org/RLSA-2024:8831 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2024-9187.html · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2024:9187 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2024:8831 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2024:8831 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-2314 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2024-9187.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-2314 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2024-2314 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-2314 · Security Note
• https://osv.dev/vulnerability/OESA-2024-2502 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-2314 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-38914 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-2314 · Security Note