Bug 2043387 (CVE-2021-45941) - CVE-2021-45941 libbpf: heap-based buffer overflow (8 bytes) in __bpf_object__open
Summary: CVE-2021-45941 libbpf: heap-based buffer overflow (8 bytes) in __bpf_object__...
Keywords:
Status: NEW
Alias: CVE-2021-45941
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2043388 2051974 2051975
Blocks: 2043392
TreeView+ depends on / blocked
 
Reported: 2022-01-21 07:08 UTC by Sandipan Roy
Modified: 2023-12-12 18:33 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in libbpf. The vulnerability occurs due to incorrect handling of memory in the __bpf_object__open function and leads to a heap-buffer-overflow. This flaw allows an attacker to execute unauthorized code or commands, read memory, or modify memory.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Sandipan Roy 2022-01-21 07:08:42 UTC 
libbpf 0.6.0 and 0.6.1 has a heap-based buffer overflow (8 bytes) in __bpf_object__open (called from bpf_object__open_mem and bpf-object-fuzzer.c).

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40957
https://bugzilla.suse.com/1194249
Comment 1 Sandipan Roy 2022-01-21 07:08:55 UTC 
Created libbpf tracking bugs for this issue:

Affects: fedora-all [bug 2043388]
Note You need to log in before you can comment on or make changes to this bug.