{"id":"CVE-2024-2313","aliases":["ALSA-2024:8830","ALSA-2024:9188","AZL-35836","AZL-35874","CLSA-2026-1778080357","DEBIAN-CVE-2024-2313","EUVD-2024-27268","GHSA-ph92-w482-m4jj","RHSA-2024:8830","RHSA-2024:9188","RLSA-2024:8830","RLSA-2024:9188","openSUSE-SU-2024:13986-1"],"status":"published","title":"If kernel headers need to be extracted, bpftrace will attempt to load them from a temporary...","description":"If kernel headers need to be extracted, bpftrace will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux distributions which provide kernel headers by default are not affected by default.","severity":{"version":"3.1","score":2.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00184,"percentile":0.08013,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-377"],"published":"2024-03-10T22:51:51Z","modified":"2026-11-02T12:00:11Z","fixes":[{"ecosystem":"AlmaLinux:8","package":"bpftrace","fixed_in":["0.16.0-6.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"bpftrace","fixed_in":["0.21.1-1.el9"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"bpftrace","fixed_in":["0.16.0-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"bpftrace","fixed_in":["0.20.3-1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"bpftrace","fixed_in":["0.16.0-2.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"bpftrace","fixed_in":["0.21.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"bpftrace","fixed_in":["0.21.0-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"bpftrace","fixed_in":["0:0.16.0-6.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"bpftrace-debuginfo","fixed_in":["0:0.16.0-6.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"bpftrace-debugsource","fixed_in":["0:0.16.0-6.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bpftrace","fixed_in":["0:0.21.1-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bpftrace-debuginfo","fixed_in":["0:0.21.1-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bpftrace-debugsource","fixed_in":["0:0.21.1-1.el9"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"bpftrace","fixed_in":["0:0.16.0-6.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"bpftrace","fixed_in":["0:0.21.1-1.el9"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"bpftrace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.0-6.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"bpftrace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.1-1.el9"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"bpftrace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.0-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"bpftrace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.3-1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bpftrace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.0-2.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"bpftrace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.17.0-1","0.17.0-2","0.19.0-1","0.19.1-1","0.20.0-1","0.20.1-1","0.20.2-1","0.21.0-1","0.21.2-1","0.21.2-2","0.21.3-1","0.22.1-1","0.23.1-1","0.23.2-1","0.23.5-1","0.24.1-1","0.24.1-1.1","0.25.0-1","0.25.1-1","0.26.1-1","0.26.1-1.1","0.27.0-1","0.27.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"bpftrace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"bpftrace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"bpftrace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.16.0-6.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"bpftrace-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.16.0-6.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"bpftrace-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.16.0-6.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bpftrace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.1-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bpftrace-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.1-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bpftrace-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.1-1.el9"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"bpftrace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.16.0-6.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"bpftrace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.1-1.el9"}]}]}],"products":[{"vendor":"bpftrace","product":"bpftrace"}],"references":[{"url":"https://github.com/bpftrace/bpftrace/commit/4be4b7191acb8218240e6b7178c30fa8c9b59998","tags":["patch","x_transferred","Patch","fix"]},{"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2313","tags":["issue-tracking","x_transferred","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2313","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-ph92-w482-m4jj"},{"url":"https://access.redhat.com/errata/RHSA-2024:8830","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-2313","tags":["report"]},{"url":"https://bugzilla.redhat.com/2269014","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-8830.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:9188","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-9188.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1778080357.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/2xxx/CVE-2024-2313.json","tags":["advisory"]},{"url":"https://github.com/bpftrace/bpftrace","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-2313","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2269014","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8830.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-2313","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.5_release_notes/index","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-30779","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9188.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:8830","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:9188","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-2313","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-2313","description":"If kernel headers need to be extracted, bpftrace will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux distributions which provide kernel headers by default are not affected by default.","status":"published","published":"2024-03-10T22:51:51.372Z","modified":"2025-03-13T21:15:14.295Z","cvss":[{"version":"3.1","score":2.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-377"],"updated_at":"2026-11-02T14:34:09.897248Z"}],"euvd":[{"id":"EUVD-2024-27268","description":"If kernel headers need to be extracted, bpftrace will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux distributions which provide kernel headers by default are not affected by default.","status":"published","published":"2024-03-10T22:51:51Z","modified":"2025-03-13T21:15:14Z","cvss":[{"version":"3.1","score":2.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T20:53:03.669796Z"}],"ghsa":[{"id":"GHSA-ph92-w482-m4jj","title":"If kernel headers need to be extracted, bpftrace will attempt to load them from a temporary...","description":"If kernel headers need to be extracted, bpftrace will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux distributions which provide kernel headers by default are not affected by default.","status":"published","published":"2024-03-11T00:30:45Z","modified":"2025-03-14T00:30:44Z","cvss":[{"version":"3.1","score":2.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-377"],"updated_at":"2026-11-02T15:00:16.694376Z"}],"nvd":[{"id":"CVE-2024-2313","description":"If kernel headers need to be extracted, bpftrace will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux distributions which provide kernel headers by default are not affected by default.","status":"published","published":"2024-03-10T23:15:53.76Z","modified":"2026-06-17T07:24:17.78Z","cvss":[{"version":"3.1","score":2.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L","level":"low","assessor":"secondary"}],"cwes":["CWE-377"],"updated_at":"2026-11-02T14:09:39.488031Z"}],"osv":[{"id":"CVE-2024-2313","description":"If kernel headers need to be extracted, bpftrace will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux distributions which provide kernel headers by default are not affected by default.","status":"published","published":"2024-03-10T22:51:51.372Z","modified":"2026-10-28T10:40:15.088372607Z","cvss":[{"version":"3.1","score":2.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:44:38.577405Z"},{"id":"DEBIAN-CVE-2024-2313","description":"If kernel headers need to be extracted, bpftrace will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux distributions which provide kernel headers by default are not affected by default.","status":"published","published":"2024-03-10T23:15:53.76Z","modified":"2026-11-02T12:00:11.951675762Z","cvss":[{"version":"3.1","score":2.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"RHSA-2024:8830","title":"Red Hat Security Advisory: bpftrace security update","status":"published","published":"2024-11-12T17:08:38Z","modified":"2026-03-18T11:36:17.516762Z","cvss":[{"version":"3.1","score":2.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2024:9188","title":"Red Hat Security Advisory: bpftrace security update","status":"published","published":"2024-11-12T18:02:12Z","modified":"2026-03-18T11:36:22.293541Z","cvss":[{"version":"3.1","score":2.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"ALSA-2024:8830","title":"Low: bpftrace security update","description":"BPFtrace is a high-level tracing language for Linux enhanced Berkeley Packet Filter (eBPF) available in recent Linux kernels (4.x). BPFtrace uses LLVM as a backend to compile scripts to BPF-bytecode and makes use of BCC for interacting with the Linux BPF system, as well as existing Linux tracing capabilities: kernel dynamic tracing (kprobes), user-level dynamic tracing (uprobes), and tracepoints. The BPFtrace language is inspired by awk and C, and predecessor tracers such as DTrace and SystemTap  \n\nSecurity Fix(es):  \n\n  * bpftrace: unprivileged users can force loading of compromised linux headers (CVE-2024-2313)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2024-11-05T00:00:00Z","modified":"2026-10-29T11:02:28.003238751Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2024:9188","title":"Low: bpftrace security update","description":"BPFtrace is a high-level tracing language for Linux enhanced Berkeley Packet Filter (eBPF) available in recent Linux kernels (4.x). BPFtrace uses LLVM as a backend to compile scripts to BPF-bytecode and makes use of BCC for interacting with the Linux BPF system, as well as existing Linux tracing capabilities: kernel dynamic tracing (kprobes), user-level dynamic tracing (uprobes), and tracepoints. The BPFtrace language is inspired by awk and C, and predecessor tracers such as DTrace and SystemTap  \n\nSecurity Fix(es):  \n\n  * bpftrace: unprivileged users can force loading of compromised linux headers (CVE-2024-2313)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  \n\nAdditional Changes:  \n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.\n","status":"published","published":"2024-11-12T00:00:00Z","modified":"2026-10-29T11:31:10.380654211Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"AZL-35836","title":"CVE-2024-2313 affecting package bpftrace for versions less than 0.16.0-3","description":"If kernel headers need to be extracted, bpftrace will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux distributions which provide kernel headers by default are not affected by default.","status":"published","published":"2024-03-10T23:15:53Z","modified":"2026-04-21T04:25:07.91402Z","updated_at":"2026-11-02T15:28:04.173658Z"},{"id":"AZL-35874","title":"CVE-2024-2313 affecting package bpftrace for versions less than 0.20.3-1","description":"If kernel headers need to be extracted, bpftrace will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux distributions which provide kernel headers by default are not affected by default.","status":"published","published":"2024-03-10T23:15:53Z","modified":"2026-04-21T04:32:45.473081Z","updated_at":"2026-11-02T15:28:04.173658Z"},{"id":"CLSA-2026-1778080357","title":"bpftrace: Fix of CVE-2024-2313","description":"- CVE-2024-2313: Prevent bpftrace from loading compromised Linux headers when\n  extracting kernel headers from temporary directory","status":"published","published":"2026-05-06T15:12:43Z","modified":"2026-06-01T00:32:28.749342697Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"openSUSE-SU-2024:13986-1","title":"bpftrace-0.20.4-1.1 on GA media","description":"These are all security issues fixed in the bpftrace-0.20.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:28:07.711199Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"RLSA-2024:8830","title":"Low: bpftrace security update","description":"BPFtrace is a high-level tracing language for Linux enhanced Berkeley Packet Filter (eBPF) available in recent Linux kernels (4.x). BPFtrace uses LLVM as a backend to compile scripts to BPF-bytecode and makes use of BCC for interacting with the Linux BPF system, as well as existing Linux tracing capabilities: kernel dynamic tracing (kprobes), user-level dynamic tracing (uprobes), and tracepoints. The BPFtrace language is inspired by awk and C, and predecessor tracers such as DTrace and SystemTap\n\nSecurity Fix(es):\n\n* bpftrace: unprivileged users can force loading of compromised linux headers (CVE-2024-2313)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-11-08T15:56:47.559546Z","modified":"2026-02-04T13:30:08.4757Z","updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"RLSA-2024:9188","title":"Low: bpftrace security update","description":"BPFtrace is a high-level tracing language for Linux enhanced Berkeley Packet Filter (eBPF) available in recent Linux kernels (4.x). BPFtrace uses LLVM as a backend to compile scripts to BPF-bytecode and makes use of BCC for interacting with the Linux BPF system, as well as existing Linux tracing capabilities: kernel dynamic tracing (kprobes), user-level dynamic tracing (uprobes), and tracepoints. The BPFtrace language is inspired by awk and C, and predecessor tracers such as DTrace and SystemTap\n\nSecurity Fix(es):\n\n* bpftrace: unprivileged users can force loading of compromised linux headers (CVE-2024-2313)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9.5 Release Notes linked from the References section.","status":"published","published":"2025-03-17T20:16:49.937392Z","modified":"2026-02-04T20:15:13.315142Z","updated_at":"2026-11-02T15:53:24.923365Z"}]}}