Impact
In Libs 0.17.0 the function sinsp_plugin::get_metrics contains a buffer overflow while concatenating the plugin name with the metric name. Both the metric name and plugin name are not directly controllable by the user or other lesser privileged programs that run on the same machine as Falco but depend on the plugin and its implementation, so in order to exploit this vulnerability there would need to be a plugin that exposes a metric name that is too long or somehow controllable by untrusted input.
Patches
The issue has been corrected in Falco libs 0.17.1 .
This patch addresses the issue: #1880
Workarounds
None
FedeDP Finder
LucaGuerra Remediation reviewer
Impact
In Libs 0.17.0 the function
sinsp_plugin::get_metricscontains a buffer overflow while concatenating the plugin name with the metric name. Both the metric name and plugin name are not directly controllable by the user or other lesser privileged programs that run on the same machine as Falco but depend on the plugin and its implementation, so in order to exploit this vulnerability there would need to be a plugin that exposes a metric name that is too long or somehow controllable by untrusted input.Patches
The issue has been corrected in Falco libs 0.17.1 .
This patch addresses the issue: #1880
Workarounds
None