CVE-2026-45684

Description

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.7.0 to before version 0.9.0, OBI's log enricher mishandles writev buffers by reading only the first iovec entry but using the total iov_iter.count as the copy length. When log injection is enabled, a crafted multi-segment writev call can make OBI read and overwrite memory beyond the first segment. This issue has been patched in version 0.9.0.

Traduire en français

Produits concernés

• open-telemetry opentelemetry-ebpf-instrumentation
• Opentelemetry ebpf instrumentation

Scores CVSS

Faiblesses (CWE)

• CWE-126
• CWE-787

Références

• https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0 ProductRelease Notes
• https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-vvmg-8mjr-g6q3 ExploitVendor Advisory
• https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-vvmg-8mjr-g6q3 ExploitVendor Advisory

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories