SB2022010106 - Heap-based buffer overflow in libbpf

Description

This security bulletin contains information about 1 vulnerability.

1) Heap-based buffer overflow (CVE-ID: CVE-2021-45941)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to a boundary error within the __bpf_object__open (called from bpf_object__open_mem and bpf-object-fuzzer.c). A remote attacker can create a specially crafted file, trick the victim into opening it, trigger heap-based buffer overflow and perform a denial of service attack.

Remediation

Install update from vendor's website.

References

• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40957
• https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libbpf/OSV-2021-1576.yaml