VDB
CVE-2024-2193
CVE-2024-2193
PUBLISHED
CVSS 5.7 MEDIUM
Reported by certcc · Published March 15, 2024
A Speculative Race Condition (SRC) vulnerability that impacts modern CPU architectures supporting speculative execution (related to Spectre V1) has been disclosed. An unauthenticated attacker can exploit this vulnerability to disclose arbitrary data from the CPU using race conditions to access the speculative executable code paths.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| kernel-libbpf-devel | Amazon Linux | 6.1.79-99.164.amzn2023 |
| kernel-headers | Amazon Linux | 6.1.79-99.164.amzn2023 |
| bpftool | Amazon Linux | 6.1.79-99.164.amzn2023 |
| python-perf | Amazon Linux | 4.14.336-257.568.amzn2 |
Risk scores
CVSS 3.1
5.7
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Affected products
| Vendor | Product | Versions |
|---|---|---|
| AMD | CPU | See advisory AMD-SB-7016 |
| Xen | Xen | consult Xen advisory XSA-453 |
| amazon:2023 | kernel-libbpf-devel | 0 |
| amazon:2023 | kernel-headers | 0 |
| amazon:2023 | bpftool | 0 |
| amazon:2 | python-perf | 0 |
| AMD | CPU | * |
| amazon:2023 | kernel-tools-devel | 0 |
| Xen | Xen | * |
| amazon:2023 | kernel-modules-extra | 0 |
| amazon:2023 | python3-perf | 0 |
| amazon:2023 | kernel-devel | 0 |
| amazon:2 | kernel-devel | 0 |
| amazon:2 | kernel-headers | 0 |
| amazon:2 | perf | 0 |
| amazon:2023 | perf | 0 |
| amazon:2023 | kernel-tools | 0 |
| amazon:2 | kernel-tools | 0 |
| amazon:2023 | kernel-modules-extra-common | 0 |
| amazon:2023 | kernel-libbpf | 0 |
…and 6 more
Timeline
- Mar 5, 2024 CVE Published
- Mar 16, 2024 EPSS Score (30 in total, the first dated here)
- Oct 4, 2024 Coalition ESS Score (9 in total, the first dated here)
- Dec 26, 2024 CVE Updated
- Jan 18, 2026 Security Advisory (5 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2024-2193
vulnetix vdb fixes CVE-2024-2193Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2024-2193/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart