Bug 1221220 (CVE-2024-2313) - VUL-0: CVE-2024-2313: bpftrace: unprivileged attacker could force bcc to load compromised linux headers
Summary: VUL-0: CVE-2024-2313: bpftrace: unprivileged attacker could force bcc to load...
Status: RESOLVED UPSTREAM
Alias: CVE-2024-2313
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Minor
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/396793/
Whiteboard: CVSSv3.1:SUSE:CVE-2024-2313:2.5:(AV:L...
Keywords:
Depends on:
Blocks:
 
Reported: 2024-03-11 07:37 UTC by SMASH SMASH
Modified: 2024-05-22 07:37 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-03-11 07:37:49 UTC 
If kernel headers need to be extracted, bpftrace will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux distributions which provide kernel headers by default are not affected by default.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-2313
https://www.cve.org/CVERecord?id=CVE-2024-2313
https://github.com/bpftrace/bpftrace/commit/4be4b7191acb8218240e6b7178c30fa8c9b59998
Comment 1 Shung-Hsi Yu 2024-03-11 07:40:08 UTC 
(In reply to SMASH SMASH from comment #0)
> ... Linux distributions which provide
> kernel headers by default are not affected by default.

Sounds like we're not affected, but I'll look into this in more detail.
Comment 2 Shung-Hsi Yu 2024-03-11 14:06:05 UTC 
Similar to what bcc does in bug 1221229, bpftrace only unpacks kernel header if kernel is built with CONFIG_IKHEADERS[1,2], hence so this vulnerability does not apply to us.

Reassigning back to security team.

1: https://github.com/bpftrace/bpftrace/commit/896fafbe9253
2: https://github.com/bpftrace/bpftrace/blob/4be4b71/src/utils.cpp#L824-L832
Comment 3 Marcus Meissner 2024-04-26 14:20:45 UTC 
fixed upstream, we are not affected
Comment 4 Shung-Hsi Yu 2024-05-22 07:37:43 UTC 
FWIW previous fix was not enough and there's a new one https://github.com/bpftrace/bpftrace/pull/3190/commits/e0919e500ecb8ec181d879efd6b600004d6cf2a9

Again, we're not affected, so I'm updating Factory/Tumbleweed version of bpftrace purely to align with the latest upstream's version rather than for the security fix.