Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| go.opentelemetry.io/obi | go | < 0.9.0 | 0.9.0 |
Miggo AIRoot Cause AnalysisThe vulnerability allows a local unprivileged process to read kernel memory. The root cause is the incorrect use of the bpf_probe_read helper in an eBPF program that processes data from a user-controlled ioctl call. The vulnerable function is obi_kprobe_sys_ioctl in bpf/generictracer/java_tls.c. This function is a kprobe attached to the do_vfs_ioctl kernel function. When a Java application instrumented by OpenTelemetry issues a specific ioctl call for TLS, this eBPF program is triggered.
The vulnerability is that the program uses bpf_probe_read to read data from a pointer passed as an argument to the ioctl call. This pointer is controlled by the user process. By supplying a pointer to a kernel address, an attacker can cause the eBPF program to read kernel memory and send it to the OpenTelemetry collector as part of the telemetry data.
The fix involves replacing bpf_probe_read with bpf_probe_read_user. The bpf_probe_read_user helper is specifically designed to safely read data from user-space pointers, preventing the eBPF program from accessing kernel memory. The patch also introduces additional checks to validate the length of the user-provided buffer.
The analysis of the fixing commit 4db1bde1724db9aa48268010b3c23135b29fad05 clearly shows these changes in the obi_kprobe_sys_ioctl function, confirming it as the vulnerable function.
obi_kprobe_sys_ioctlbpf/generictracer/java_tls.c