Amazon Linux 2 : libbpf (ALAS-2023-1969)

The version of libbpf installed on the remote host is prior to 0.5.0-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1969 advisory. A vulnerability was found in Linux Kernel. It has been classified as problematic. This affects the function findprogbysecinsn of the...

Security fix for the ALT Linux 10 package libbpf version 0.8.1-alt2

0.8.1-alt2 built Feb. 21, 2023 Vitaly Chikunov in task 315256 Feb. 15, 2023 Vitaly Chikunov - Fixes: CVE-2022-3534, CVE-2022-3606...

SUSE CVE-2021-45940

libbpf 0.6.0 and 0.6.1 has a heap-based buffer overflow 4 bytes in bpfobjectopen called from bpfobjectopenmem and bpf-object-fuzzer.c...

SUSE CVE-2021-45941

libbpf 0.6.0 and 0.6.1 has a heap-based buffer overflow 8 bytes in bpfobjectopen called from bpfobjectopenmem and bpf-object-fuzzer.c...

SUSE CVE-2022-3534

A vulnerability classified as critical has been found in Linux Kernel. Affected is the function btfdumpnamedups of the file tools/lib/bpf/btfdump.c of the component libbpf. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libbpf (SUSE-SU-2023:0405-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0405-1 advisory. - CVE-2022-3534: Fixed use-after-free in btfdumpnamedups bsc1204391. - CVE-2022-3606: Fixed null...

SUSE: Security Advisory (SUSE-SU-2023:0405-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2023:0405-1 Security update for libbpf

This update for libbpf fixes the following issues: - CVE-2022-3534: Fixed use-after-free in btfdumpnamedups bsc1204391. - CVE-2022-3606: Fixed null pointer dereference in findprogbysecinsn bsc1204502...

CVE-2022-3534

A use-after-free flaw was found in btfdumpnamedups in tools/lib/bpf/btfdump.c in libbpf in the Linux Kernel. This issue occurs because the key stored in the hash table namemap is a string address, and the string memory is allocated by realloc function. When the memory is resized by realloc later,...

Ubuntu: Security Advisory (USN-5759-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-5759-1: LibBPF vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description It was discovered that LibBPF incorrectly handled certain memory operations under certain circumstances. An attacker could possibly use this issue to cause LibBPF to crash, resulting in a denial of servic...

GSD-2023-1001484 libbpf: Fix use-after-free in btf_dump_name_dups

libbpf: Fix use-after-free in btfdumpnamedups This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.163 by commit...

GSD-2023-1001483 libbpf: Fix null-pointer dereference in find_prog_by_sec_insn()

libbpf: Fix null-pointer dereference in findprogbysecinsn This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.163 by commit...

GSD-2023-1001316 libbpf: Avoid enum forward-declarations in public API in C++ mode

libbpf: Avoid enum forward-declarations in public API in C++ mode This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.163 by commit...

GSD-2023-1001182 libbpf: Fix use-after-free in btf_dump_name_dups

libbpf: Fix use-after-free in btfdumpnamedups This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.86 by commit...

GSD-2023-1001181 libbpf: Fix null-pointer dereference in find_prog_by_sec_insn()

libbpf: Fix null-pointer dereference in findprogbysecinsn This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.86 by commit...

GSD-2023-1000983 libbpf: Avoid enum forward-declarations in public API in C++ mode

libbpf: Avoid enum forward-declarations in public API in C++ mode This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.86 by commit...

GSD-2023-1000803 libbpf: Fix use-after-free in btf_dump_name_dups

libbpf: Fix use-after-free in btfdumpnamedups This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.16 by commit...

GSD-2023-1000802 libbpf: Fix memory leak in parse_usdt_arg()

libbpf: Fix memory leak in parseusdtarg This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.16 by commit...

GSD-2023-1000799 libbpf: Use elf_getshdrnum() instead of e_shnum

libbpf: Use elfgetshdrnum instead of eshnum This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.16 by commit...