CVE-2021-45940 — Out-of-bounds Write in Libbpf

CWE-787 — Out-of-bounds WriteCWE-120 — Classic Buffer OverflowCWE-131 — Incorrect Calculation of Buffer Size9 documents6 sources
Severity
6.5MEDIUMNVD
EPSS
0.2%
top 63.23%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Libbpf Project LibbpfDebian Libbpf
Timeline
PublishedJan 1
Latest updateDec 8

Description

libbpf 0.6.0 and 0.6.1 has a heap-based buffer overflow (4 bytes) in __bpf_object__open (called from bpf_object__open_mem and bpf-object-fuzzer.c).

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages4 packages

▶debiandebian/libbpf< libbpf 0.7.0-2 (bookworm)
▶Debianlibbpf_project/libbpf< 0.7.0-2+2
▶Ubuntulibbpf_project/libbpf< 0.5.0-1ubuntu22.04.1+1
▶NVDlibbpf_project/libbpf0.6.0, 0.6.1+1

🔴Vulnerability Details

4
OSV
libbpf vulnerabilities↗2022-12-08
▶
OSV
libbpf vulnerabilities↗2022-12-05
▶
GHSA
GHSA-5jr4-6rxr-3x73: libbpf 0↗2022-01-02
▶
OSV
CVE-2021-45940: libbpf 0↗2022-01-01
▶

📋Vendor Advisories

4
Ubuntu
LibBPF vulnerabilities↗2022-12-08
▶
Ubuntu
LibBPF vulnerabilities↗2022-12-05
▶
Red Hat
libbpf: heap-based buffer overflow (4 bytes) in __bpf_object__open↗2022-01-01
▶
Debian
CVE-2021-45940: libbpf - libbpf 0.6.0 and 0.6.1 has a heap-based buffer overflow (4 bytes) in __bpf_objec...↗2021
▶