https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 19:40:23 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-324073 EUVD-2026-324073 https://cve.radiocsirt.org/vuln/euvd-2026-324073 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45683 <p>OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the Java TLS ioctl probe reads user-controlled ioctl pointers with bpf_probe_read instead of bpf_probe_read_user. An instrumented local process can therefore point OBI at kernel memory and cause that memory to be copied into telemetry. This issue has been patched in version 0.9.0.</p> <p>OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the Java TLS ioctl probe reads user-controlled ioctl pointers with bpf_probe_read instead of bpf_probe_read_user. An instrumented local process can therefore point OBI at kernel memory and cause that memory to be copied into telemetry. This issue has been patched in version 0.9.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-45683 https://cve.radiocsirt.org/vuln/ghsa-fjq3-ffvr-vm46 <p><strong>Affected:</strong> Go: go.opentelemetry.io/obi</p> <p>### Summary</p> <p>The Java TLS ioctl probe reads user-controlled ioctl pointers with `bpf_probe_read` instead of `bpf_probe_read_user`. An instrumented local process can therefore point OBI at kernel memory and cause that memory to be copied into telemetry.</p> <p>### Details</p> <p>The vulnerable path is in [bpf/generictracer/java_tls.c](https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/blob/360521f411213566a3b557a1f0c093e6cd68a4de/bpf/generictracer/java_tls.c#L66-L163). The kprobe hooks `do_vfs_ioctl`, filters on `fd == 0` and the Java TLS magic command, and then treats the third ioctl argument as a structured buffer. It reads fields from that pointer using `bpf_probe_read`, including:</p> <p>- the operation byte from `arg` - connection metadata from `arg + 1` - the payload length from `arg + 1 + sizeof(connection_info_t)`</p> <p>If `len &gt; 0`, it computes `buf = arg + 1 + sizeof(connection_info_t) + sizeof(u32)` and passes that pointer into [`handle_buf_with_connection`](https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/blob/360521f411213566a3b557a1f0c093e6cd68a4de/bpf/generictracer/k_tracer_defs.h#L67).</p> <p>The next stage, [bpf/generictracer/k_tracer_defs.h](https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/blob/360521f411213566a3b557a1f0c093e6cd68a4de/bpf/generictracer/k_tracer_defs.h#L62), uses [`bpf_probe_read(args-&gt;small_buf, MIN_HTTP2_SIZE, (void *)args-&gt;u_buf);`](https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/blob/36052…</p> <p><strong>Affected:</strong> Go: go.opentelemetry.io/obi</p> <p>### Summary</p> <p>The Java TLS ioctl probe reads user-controlled ioctl pointers with `bpf_probe_read` instead of `bpf_probe_read_user`. An instrumented local process can therefore point OBI at kernel memory and cause that memory to be copied into telemetry.</p> <p>### Details</p> <p>The vulnerable path is in [bpf/generictracer/java_tls.c](https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/blob/360521f411213566a3b557a1f0c093e6cd68a4de/bpf/generictracer/java_tls.c#L66-L163). The kprobe hooks `do_vfs_ioctl`, filters on `fd == 0` and the Java TLS magic command, and then treats the third ioctl argument as a structured buffer. It reads fields from that pointer using `bpf_probe_read`, including:</p> <p>- the operation byte from `arg` - connection metadata from `arg + 1` - the payload length from `arg + 1 + sizeof(connection_info_t)`</p> <p>If `len &gt; 0`, it computes `buf = arg + 1 + sizeof(connection_info_t) + sizeof(u32)` and passes that pointer into [`handle_buf_with_connection`](https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/blob/360521f411213566a3b557a1f0c093e6cd68a4de/bpf/generictracer/k_tracer_defs.h#L67).</p> <p>The next stage, [bpf/generictracer/k_tracer_defs.h](https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/blob/360521f411213566a3b557a1f0c093e6cd68a4de/bpf/generictracer/k_tracer_defs.h#L62), uses [`bpf_probe_read(args-&gt;small_buf, MIN_HTTP2_SIZE, (void *)args-&gt;u_buf);`](https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/blob/36052…</p> https://cve.radiocsirt.org/vuln/ghsa-fjq3-ffvr-vm46 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11803-1 <p>alloy-1.19.2-1.1 on GA media</p> <p>alloy-1.19.2-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11803-1