Bug 2269014 (CVE-2024-2313)

Summary: CVE-2024-2313 bpftrace: unprivileged users can force loading of compromised linux headers
Product: [Other] Security Response Reporter: TEJ RATHI <trathi>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: bpftrace 0.20.2 Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in BPFtrace. This issue occurs when extracting kernel headers, it tries to load them from a temporary directory. This issue could allow an attacker to force bpftrace to load compromised Linux headers by placing malicious headers in the temporary directory, leading to potential security risks, unauthorized access, or system compromise.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2269015    
Bug Blocks: 2269018    

Description TEJ RATHI 2024-03-11 14:15:51 UTC 
If kernel headers need to be extracted, bpftrace will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux distributions which provide kernel headers by default are not affected by default.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2313
https://github.com/bpftrace/bpftrace/commit/4be4b7191acb8218240e6b7178c30fa8c9b59998
Comment 1 TEJ RATHI 2024-03-11 14:17:31 UTC 
Created bpftrace tracking bugs for this issue:

Affects: fedora-all [bug 2269015]
Comment 3 errata-xmlrpc 2024-11-05 00:34:28 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:8830 https://access.redhat.com/errata/RHSA-2024:8830
Comment 4 errata-xmlrpc 2024-11-12 09:03:44 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:9188 https://access.redhat.com/errata/RHSA-2024:9188