The vulnerability of the btf_dump_name_dups() function in the tools/lib/bpf/btf_dump.c library of the libbpf library (Berkeley Packet Filters) in the Linux operating system’s kernel allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the libbpf library Berkeley Packet Filters in the Linux operating system is related to the reutilization of previously freed memory. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information...

Ubuntu 20.04 ESM : LibBPF vulnerabilities (USN-5759-2)

The remote Ubuntu 20.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5759-2 advisory. USN-5759-1 fixed vulnerabilities in LibBPF. This update provides the corresponding updates for Ubuntu 20.04 ESM. Tenable has extracted the preceding...

CLSA-2023-1693904331 Fix of 11 CVEs

Jammy update: v5.15.86 upstream stable release LP: 2005113 // CVE-url: https://ubuntu.com/security/CVE-2022-3606 - libbpf: Fix null-pointer dereference in findprogbysecinsn Jammy update: v5.15.87 upstream stable release LP: 2007441 // CVE-url: https://ubuntu.com/security/CVE-2023-23454 - net:...

CLSA-2023-1693827322 Fix of 9 CVEs

Jammy update: v5.15.86 upstream stable release LP: 2005113 // CVE-url: https://ubuntu.com/security/CVE-2022-3606 - libbpf: Fix null-pointer dereference in findprogbysecinsn Jammy update: v5.15.87 upstream stable release LP: 2007441 // CVE-url: https://ubuntu.com/security/CVE-2023-23454 - net:...

Possibility of deadlock in libbpf function sock_hash_delete_elem

...

Linux Kernel BPF libbpf.c find_prog_by_sec_insn null pointer dereference

...

Ubuntu 18.04 ESM / 20.04 LTS : dwarves vulnerabilities (USN-6215-1)

The remote Ubuntu 18.04 ESM / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6215-1 advisory. It was discovered that dwarves incorrectly handled certain memory operations under certain circumstances. An attacker could possibly use this...

Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2023-2335)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

libbpf bug fix and enhancement update

An update is available for libbpf. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linux 9.2...

Important Photon OS Security Update - PHSA-2023-4.0-0377

Updates of 'libbpf' packages of Photon OS have been released...

Mageia: Security Advisory (MGASA-2023-0008)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Amazon Linux 2 : libbpf (ALAS-2023-1969)

The version of libbpf installed on the remote host is prior to 0.5.0-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1969 advisory. A vulnerability was found in Linux Kernel. It has been classified as problematic. This affects the function findprogbysecinsn of the...

Security fix for the ALT Linux 10 package libbpf version 0.8.1-alt2

0.8.1-alt2 built Feb. 21, 2023 Vitaly Chikunov in task 315256 Feb. 15, 2023 Vitaly Chikunov - Fixes: CVE-2022-3534, CVE-2022-3606...

SUSE CVE-2021-45940

libbpf 0.6.0 and 0.6.1 has a heap-based buffer overflow 4 bytes in bpfobjectopen called from bpfobjectopenmem and bpf-object-fuzzer.c...

SUSE CVE-2021-45941

libbpf 0.6.0 and 0.6.1 has a heap-based buffer overflow 8 bytes in bpfobjectopen called from bpfobjectopenmem and bpf-object-fuzzer.c...

SUSE CVE-2022-3534

A vulnerability has been found in Linux Kernel up to 5.10.162/5.15.85/6.0.15/6.1.1. The impacted element is the function btfdumpnamedups of the file tools/lib/bpf/btfdump.c of the component libbpf. The manipulation leads to use after free. Upgrading to version 5.10.163, 5.15.86, 6.0.16, 6.1.2 and...

SUSE: Security Advisory (SUSE-SU-2023:0405-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libbpf (SUSE-SU-2023:0405-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0405-1 advisory. - CVE-2022-3534: Fixed use-after-free in btfdumpnamedups bsc1204391. - CVE-2022-3606: Fixed null...

SUSE-SU-2023:0405-1 Security update for libbpf

This update for libbpf fixes the following issues: - CVE-2022-3534: Fixed use-after-free in btfdumpnamedups bsc1204391. - CVE-2022-3606: Fixed null pointer dereference in findprogbysecinsn bsc1204502...

CVE-2022-3534

A use-after-free flaw was found in btfdumpnamedups in tools/lib/bpf/btfdump.c in libbpf in the Linux Kernel. This issue occurs because the key stored in the hash table namemap is a string address, and the string memory is allocated by realloc function. When the memory is resized by realloc later,...