Executive brief
The cilium ebpf library is used to parse eBPF (extended Berkeley Packet Filter) program metadata from compiled ELF binary files. A flaw in the BTF (BPF Type Format) string table parsing allows malformed ELF files to trigger an integer overflow and cause a denial-of-service crash. This affects any application that loads and parses untrusted or user-supplied eBPF binaries.
Technical details
The vulnerability is an integer overflow in the BTF string table offset validation logic within the loadRawSpec function in btf/btf.go. When parsing BTF metadata from ELF files, the code performs a bounds check by adding two 32-bit unsigned integers (header.StringOff + header.StringLen) without promoting them to 64-bit integers first, allowing the sum to overflow. Additionally, the parser incorrectly treats a string offset equal to StringLen as valid when it should be rejected. A malformed BTF record with a crafted string offset causes the parser to panic with "slice bounds out of range" instead of returning a parse error. The attack vector is local, requiring the ability to supply a malicious ELF file to an application that calls LoadCollectionSpec or LoadCollectionSpecFromReader. The fix, available in version 0.22.0, casts the uint32 values to uint64 before addition and adds proper boundary validation.
Affected products
- cilium ebpf < 0.22.0
Timeline
- 2026-05-26: disclosed
- 2026-05-27: patched: Fix merged in PR #2021; patch commit 533dfc82fd228bfadf42ea7180c39de7d9af47fa
- 2026-06-03: advisory