CVE-2024-24890
Command injection in ioprobe of gala-gopher
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler gala-gopher on Linux allows Command Injection. This vulnerability is associated with program files https://gitee.Com/openeuler/gala-gopher/blob/master/src/probes/extends/ebpf.Probe/src/ioprobe/ioprobe.C.
This issue affects gala-gopher: through 1.0.2.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Command injection in ioprobe of gala-gopher
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler gala-gopher on Linux allows Command Injection. This vulnerability is associated with program files https://gitee.Com/openeuler/gala-gopher/blob/master/src/probes/extends/ebpf.Probe/src/ioprobe/ioprobe.C.
This issue affects gala-gopher: through 1.0.2.
- Record
CVE-2024-24890- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
EUVDEUVD-2024-22253
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler gala-gopher on Linux allows Command Injection. This vulnerability is associated with program files https://gitee.Com/openeuler/gala-gopher/blob/master/src/probes/extends/ebpf.Probe/src/ioprobe/ioprobe.C.
This issue affects gala-gopher: through 1.0.2.
- Record
EUVD-2024-22253- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q35v-9jf2-h48r
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')...
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler gala-gopher on Linux allows Command Injection. This vulnerability is associated with program files https://gitee.Com/openeuler/gala-gopher/blob/master/src/probes/extends/ebpf.Probe/src/ioprobe/ioprobe.C.
This issue affects gala-gopher: through 1.0.2.
- Record
GHSA-q35v-9jf2-h48r- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
NVD
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler gala-gopher on Linux allows Command Injection. This vulnerability is associated with program files https://gitee.Com/openeuler/gala-gopher/blob/master/src/probes/extends/ebpf.Probe/src/ioprobe/ioprobe.C.
This issue affects gala-gopher: through 1.0.2.
- Record
CVE-2024-24890- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
OSVOESA-2024-1277
gala-gopher security update
gala-gopher is a low-overhead eBPF-based probes framework
Security Fix(es):
gala-gopher 1.0.2组件中存在命令注入攻击漏洞(CVE-2024-24890)
- Record
OESA-2024-1277- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2024-1278
gala-gopher security update
gala-gopher is a low-overhead eBPF-based probes framework
Security Fix(es):
gala-gopher 1.0.2组件中存在命令注入攻击漏洞(CVE-2024-24890)
- Record
OESA-2024-1278- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2024-1279
gala-gopher security update
gala-gopher is a low-overhead eBPF-based probes framework
Security Fix(es):
gala-gopher 1.0.2组件中存在命令注入攻击漏洞(CVE-2024-24890)
- Record
OESA-2024-1279- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gala-gopheropenEuler:22.03-LTS-SP3 |
before 1.0.2-4.oe2203sp3 | 1.0.2-4.oe2203sp3 |
gala-gopheropenEuler:22.03-LTS-SP1 |
before 1.0.2-4.oe2203sp1 | 1.0.2-4.oe2203sp1 |
gala-gopheropenEuler:22.03-LTS-SP2 |
before 1.0.2-4.oe2203sp2 | 1.0.2-4.oe2203sp2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-24890 is a high vulnerability (CVSS 7.8) in Openeuler Gala-gopher, published March 15, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.05%, the 64th percentile. Fixed in gala-gopher 1.0.2-4.oe2203sp3.
References
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2024-1278
gitee.com/src-openeuler/gala-gopher/pulls/81
Show 5 moreShow less
nvd.nist.gov/vuln/detail/CVE-2024-24890
github.com/advisories/GHSA-q35v-9jf2-h48r