CVE-2026-45683

Katalog CVE

CVSS 3.8 · Low EPSS 0,17%

Kerentanan Buffer Under-read pada opentelemetry ebpf instrumentation. Skor CVSS 3.1 3.8 (Low) menurut github.com.

Deskripsi (NVD)

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the Java TLS ioctl probe reads user-controlled ioctl pointers with bpf_probe_read instead of bpf_probe_read_user. An instrumented local process can therefore point OBI at kernel memory and cause that memory to be copied into telemetry. This issue has been patched in version 0.9.0.

Rincian

Terbit di NVD

2 Juni 2026

Terakhir diubah

22 Juli 2026

Status NVD

Analyzed

CVSS 3.1

3.8 (Low), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-127: Buffer Under-read
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,17% peluang dieksploitasi; lebih tinggi dari 6,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-fjq3-ffvr-vm46 exploit · advisory vendor
• https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0 product · release notes