#cwe-127

共收录 2 条相关安全情报。

← 返回所有主题
CVE-2026-45683

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the Java TLS ioctl probe reads user-controlled ioctl pointers with bpf_probe_read instead of bpf_probe_read_user. An instrumented local process can therefore point OBI at kernel memory and cause that memory to be copied into telemetry. This issue has been patched in version

💡 影响/原因: 原文内容(由于配额限制,未进行深度 LLM 分析)

🎯 建议动作: 建议根据原文自行评估

排序因子: Primary 数据源 (+3) | LLM 评分加成 (+0.4)
go.opentelemetry.io/obi

### Summary The Java TLS ioctl probe reads user-controlled ioctl pointers with `bpf_probe_read` instead of `bpf_probe_read_user`. An instrumented local process can therefore point OBI at kernel memory and cause that memory to be copied into telemetry. ### Details The vulnerable path is in [bpf/generictracer/java_tls.c](https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/blob/36

💡 风险点: 原文内容(由于配额限制,未进行深度 LLM 分析)

🎯 建议动作: 建议根据原文自行评估

排序因子: 有可用补丁/修复方案 (+3) | Secondary 数据源 (+2) | 包含 CVE (+2) | LLM 评分加成 (+0.4)