Executive brief
OpenTelemetry eBPF Instrumentation is a tool used to monitor and collect performance data from running applications. A security vulnerability in its file-parsing component allows a local user to crash the monitoring agent by running a specially crafted, malformed program. This results in a denial-of-service, causing a loss of visibility and observability data for all other applications on the affected system.
Technical details
The OpenTelemetry eBPF Instrumentation (OBI) agent's custom ELF parser (fastelf) fails to validate section offsets, counts, and string offsets when inspecting local executables. Specifically, the 'matchExeSymbols' and 'NewElfContextFromData' functions trust metadata from the ELF header, such as Shoff and Shnum, without verifying they fall within the actual data bounds. An attacker with local execution privileges can provide a malformed ELF binary that triggers an out-of-bounds slice or a nil pointer dereference in 'GetCStringUnsafe' or 'ReadStruct'. This causes the agent to panic and terminate during process language detection. The issue is addressed in version 0.9.0 by adding overflow, bounds, and type checks.
Affected products
- OpenTelemetry OpenTelemetry eBPF Instrumentation (OBI) Prior to 0.9.0
Timeline
- 2026-05-11: patched: Version 0.9.0 released
- 2026-05-12: advisory: GitHub Security Advisory GHSA-wp73-mwgf-4jq9 published
- 2026-06-02: disclosed: CVE-2026-45676 published to NVD