OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the Java TLS ioctl probe reads user-controlled ioctl pointers with bpf_probe_read instead of bpf_probe_read_user. An instrumented local process can therefore point OBI at kernel memory and cause that memory to be copied into telemetry. This issue has been patched in version 0.9.0.

Affected: Go: go.opentelemetry.io/obi

### Summary

The Java TLS ioctl probe reads user-controlled ioctl pointers with `bpf_probe_read` instead of `bpf_probe_read_user`. An instrumented local process can therefore point OBI at kernel memory and cause that memory to be copied into telemetry.

### Details

The vulnerable path is in [bpf/generictracer/java_tls.c](https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/blob/360521f411213566a3b557a1f0c093e6cd68a4de/bpf/generictracer/java_tls.c#L66-L163). The kprobe hooks `do_vfs_ioctl`, filters on `fd == 0` and the Java TLS magic command, and then treats the third ioctl argument as a structured buffer. It reads fields from that pointer using `bpf_probe_read`, including:

- the operation byte from `arg` - connection metadata from `arg + 1` - the payload length from `arg + 1 + sizeof(connection_info_t)`

If `len > 0`, it computes `buf = arg + 1 + sizeof(connection_info_t) + sizeof(u32)` and passes that pointer into [`handle_buf_with_connection`](https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/blob/360521f411213566a3b557a1f0c093e6cd68a4de/bpf/generictracer/k_tracer_defs.h#L67).

The next stage, [bpf/generictracer/k_tracer_defs.h](https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/blob/360521f411213566a3b557a1f0c093e6cd68a4de/bpf/generictracer/k_tracer_defs.h#L62), uses [`bpf_probe_read(args->small_buf, MIN_HTTP2_SIZE, (void *)args->u_buf);`](https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/blob/36052…

alloy-1.19.2-1.1 on GA media