Description
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.7.0 to before version 0.9.0, OBI-s log enricher mishandles writev buffers by reading only the first iovec entry but using the total iov_iter.count as the copy length. When log injection is enabled, a crafted multi-segment writev call can make OBI read and overwrite memory beyond the first segment. This issue has been patched in version 0.9.0.
CVSS 4.9EPSS 0.172%Risk 0.5
View source- Published
- 2026-06-02 16:16:43
- Affected versions
- >=0.7.0,<0.9.0
- Type
- Core software
- Last modified
- 2026-07-22 19:10:00
- Vector
- CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L