Bug 2043383 (CVE-2021-45940) - CVE-2021-45940 libbpf: heap-based buffer overflow (4 bytes) in __bpf_object__open
Summary: CVE-2021-45940 libbpf: heap-based buffer overflow (4 bytes) in __bpf_object__...
Keywords:
Status: NEW
Alias: CVE-2021-45940
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2043384 2051966 2051967
Blocks: 2043392
TreeView+ depends on / blocked
 
Reported: 2022-01-21 07:01 UTC by Sandipan Roy
Modified: 2023-12-12 18:31 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in libbpf. The vulnerability occurs due to incorrect handling of memory in the __bpf_object__open function and leads to a heap-buffer-overflow. This flaw allows an attacker to execute unauthorized code or commands, read memory, or modify memory.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Sandipan Roy 2022-01-21 07:01:56 UTC 
libbpf 0.6.0 and 0.6.1 has a heap-based buffer overflow (4 bytes) in __bpf_object__open (called from bpf_object__open_mem and bpf-object-fuzzer.c).

Ref: 
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40868
https://bugzilla.suse.com/1194248
Comment 1 Sandipan Roy 2022-01-21 07:02:12 UTC 
Created libbpf tracking bugs for this issue:

Affects: fedora-all [bug 2043384]
Note You need to log in before you can comment on or make changes to this bug.