CVE-2026-45684
MEDIUM
4,9
Source: [email protected]
Attack Vector: local
Attack Complexity: high
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: low
Integrity: low
Availability: low
Description
AI Translation Available
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.7.0 to before version 0.9.0, OBI's log enricher mishandles writev buffers by reading only the first iovec entry but using the total iov_iter.count as the copy length. When log injection is enabled, a crafted multi-segment writev call can make OBI read and overwrite memory beyond the first segment. This issue has been patched in version 0.9.0.
126
Buffer Over-read
DraftCommon Consequences
Security Scopes Affected:
Confidentiality
Availability
Integrity
Potential Impacts:
Read Memory
Bypass Protection Mechanism
Dos: Crash, Exit, Or Restart
Applicable Platforms
Languages:
Memory-Unsafe, C, C++
787
Out-of-bounds Write
DraftCommon Consequences
Security Scopes Affected:
Integrity
Availability
Other
Potential Impacts:
Modify Memory
Execute Unauthorized Code Or Commands
Dos: Crash, Exit, Or Restart
Unexpected State
Applicable Platforms
Languages:
Memory-Unsafe, C, C++, Assembly
Technologies:
ICS/OT
https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/a…
https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/t…
https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/a…