Integer overflow in libseccomp - #VU139165

Vulnerability details

The vulnerability allows a remote attacker to cause heap corruption.

The vulnerability exists due to integer overflow in seccomp BPF generation in libseccomp when compiling unusually large attacker-controlled seccomp profiles. A remote attacker can supply a specially crafted oversized seccomp profile to cause heap corruption.

This issue can occur when generated BPF instruction counts exceed 65,535 and wrap the internal struct bpf_program.blk_cnt field; the resulting corruption may include a double-free.

Affected software

Remediation

External References

• https://github.com/seccomp/libseccomp/security/advisories/GHSA-2hqh-5c36-grrm
• https://github.com/seccomp/libseccomp/commit/dc9fcd66d0c282a698f1f036a9af61c9aae967eb

Related Security Bulletins

• Multiple vulnerabilities in libseccomp