https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40868

https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libbpf/OSV-2021-1562.yaml

The remote Ubuntu 22.04 LTS / 22.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5759-1 advisory.

  - libbpf 0.6.0 and 0.6.1 has a heap-based buffer overflow (4 bytes) in __bpf_object__open (called from     bpf_object__open_mem and bpf-object-fuzzer.c). (CVE-2021-45940)

  - libbpf 0.6.0 and 0.6.1 has a heap-based buffer overflow (8 bytes) in __bpf_object__open (called from     bpf_object__open_mem and bpf-object-fuzzer.c). (CVE-2021-45941)

  - A vulnerability was found in Linux Kernel. It has been rated as problematic. This issue affects the     function parse_usdt_arg of the file tools/lib/bpf/usdt.c of the component BPF. The manipulation of the     argument reg_name leads to memory leak. It is recommended to apply a patch to fix this issue. The     associated identifier of this vulnerability is VDB-211031. (CVE-2022-3533)

  - A vulnerability classified as critical has been found in Linux Kernel. Affected is the function     btf_dump_name_dups of the file tools/lib/bpf/btf_dump.c of the component libbpf. The manipulation leads to     use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability     is VDB-211032. (CVE-2022-3534)

  - A vulnerability was found in Linux Kernel. It has been classified as problematic. This affects the     function find_prog_by_sec_insn of the file tools/lib/bpf/libbpf.c of the component BPF. The manipulation     leads to null pointer dereference. It is recommended to apply a patch to fix this issue. The identifier     VDB-211749 was assigned to this vulnerability. (CVE-2022-3606)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

CVE-2021-45940

medium

Tenable Plugins

high