dbcve.org
OS Command InjectionWeakness · CWE-78

CVE-2024-24890

HIGH · 7.8 CVSS v3.1 Published 2024-03-25
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
80/100
Remediation priority · High
Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler gala-gopher on Linux allows Command Injection. This vulnerability is associated with program files https://gitee.Com/openeuler/gala-gopher/blob/master/src/probes/extends/ebpf.Probe/src/ioprobe/ioprobe.C. This issue affects gala-gopher: through 1.0.2.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

OS Command Injection vulnerability in openEuler gala-gopher's ioprobe component (ioprobe.c) allows attackers to execute arbitrary OS commands through improper neutralization of special elements. This exists in the ebpf probe functionality of the gala-gopher monitoring tool.

Mitigationremediate by implementing strict input validation and using parameterized execution methods instead of shell command invocation in the ioprobe component. Upgrade to a patched version once available.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Verify gala-gopher package installation
    Check if the gala-gopher package is installed on the system. On openEuler-based systems, run: `rpm -qa | grep gala-gopher` or `dpkg -l | grep gala-gopher` depending on the package manager.
    Affected if The gala-gopher package is installed and its version falls within the vulnerable range or cannot be verified as patched.
  2. Check installed gala-gopher version
    Retrieve the exact version of the installed gala-gopher package using the package manager. For example: `rpm -q gala-gopher --queryformat '%{VERSION}-%{RELEASE}'`
    Affected if The installed version matches the vulnerable versions or cannot be confirmed as patched against this issue.
  3. Identify ioprobe component usage
    Locate and inspect the ioprobe.c file within the gala-gopher installation. Check for the presence of the ioprobe component by searching for the binary or configuration files related to it, typically found in the gala-gopher installation directory under the ebpf or probe-related paths.
    Affected if The ioprobe.c file exists and the ioprobe functionality is present in the installation.
  4. Check ebpf probe configuration
    Examine the gala-gopher configuration files and ebpf probe definitions to determine if ioprobe functionality is enabled or can be invoked. Look for configuration files that reference ioprobe, ebpf probes, or command execution paths.
    Affected if The ebpf probe functionality using ioprobe is enabled or configurable, allowing external input to reach command execution paths.
  5. Inspect command execution patterns in ioprobe
    Review the ioprobe.c source code or binary for evidence of shell command invocation without proper input sanitization. Check for functions that execute system commands, shell calls, or similar operations that could be influenced by external input.
    Affected if The ioprobe component uses shell command execution methods without parameterized input handling, indicating the vulnerability is present.

A system is affected if gala-gopher is installed with the ioprobe component and its version contains the command injection flaw in the ebpf probe functionality.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

From vendor data
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

remediate by implementing strict input validation and using parameterized execution methods instead of shell command invocation in the ioprobe component. Upgrade to a patched version once available.

Have this fixed Scoped from the published advisory
  • Consultation4.0 h
  • Implementation8.0 h
  • Testing6.0 h
  • Review / QA4.0 h
22.0 hours of engineering $3,860
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $6,176.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2024-24890 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2024-24890 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data