CVE-2024-2313

Published: Mar 10, 2024Modified: Jun 17, 2026

2.8

Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L

Exploitability: 1.1 / Impact: 1.4

Source: security@ubuntu.com (Secondary)

Description

If kernel headers need to be extracted, bpftrace will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux distributions which provide kernel headers by default are not affected by default.

Affected (1)

Products: Bpftrace: Bpftrace

1 product

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Bpftrace Bpftrace	Before 0.20.2

Running on/with	Platform Versions
Linux Linux Kernel	All versions

Related CWEs

Insecure Temporary File

Creating and using insecure temporary files can leave application and system data vulnerable to attack.

References (4)

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2313

Source: security@ubuntu.com

Third Party Advisory

https://github.com/bpftrace/bpftrace/commit/4be4b7191acb8218240e6b7178c30fa8c9b59998

Source: security@ubuntu.com

Patch

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2313

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://github.com/bpftrace/bpftrace/commit/4be4b7191acb8218240e6b7178c30fa8c9b59998

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

Timeline

No history available yet.