Description

OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages. Starting in version 0.0.202527 and prior to version 0.0.202622, an unprivileged process can cause the profiler to open a nonregular mapping file, such as a FIFO, and block indefinitely, preventing further ELF analysis and causing a denial of service. Version 0.0.202622 contains a patch. No known workarounds are available.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.2",
  "pubDate": "2026-09-11T22:16:37.400Z",
  "pubdate": "2026-09-11T22:16:37.400Z",
  "executiveSummary": "The OpenTelemetry eBPF Profiler is susceptible to a Denial of Service (DoS) vulnerability triggered by an unprivileged process.\nThe flaw exists in the profiler's handling of memory mappings, specifically when an attacker forces the agent to interact with non-regular files such as FIFOs.\nBy inducing the profiler to open a FIFO, an unprivileged user can cause the profiler's analysis thread to block indefinitely, effectively halting ELF analysis and crashing the profiling capabilities for the affected system.\nThis vulnerability impacts OpenTelemetry eBPF Profiler versions 0.0.202527 through 0.0.202621.\nThe risk implication is a total loss of profiling availability, which can impede system observability and performance monitoring.\nNo authentication is required for an attacker to initiate this exploitation, as the interaction relies on the profiler's indiscriminate scanning or monitoring behavior of file mappings within the system environment.",
  "technicalDetails": "The vulnerability resides in the core profiling logic responsible for traversing memory mappings of target processes to perform ELF analysis. The profiler is designed to examine memory-mapped files to symbolize or profile application code; however, it fails to sufficiently validate the file type during the file opening sequence.\nThe root cause is the profiler's inability to distinguish between standard regular files and specialized file types, such as named pipes (FIFOs). When the profiler attempts to open or read from a mapping that points to a FIFO, the underlying I/O operation blocks waiting for a corresponding reader or writer on the other end of the pipe.\nThe attack flow begins with an unprivileged process creating a FIFO or manipulating its memory mapping path to point to a non-regular file. When the OpenTelemetry eBPF Profiler scans the process's address space as part of its routine profiling task, it attempts to resolve the path associated with these mappings. Upon encountering the FIFO, the thread executing the analysis blocks synchronously.\nBecause the analysis thread blocks indefinitely on the FIFO read/open operation, it becomes unavailable to process further profiling requests or continue the analysis of other legitimate mappings. This leads to a denial of service where the profiling agent becomes effectively unresponsive, failing to produce telemetry for the entire system or monitored target environment.\nThis vulnerability is particularly significant in multi-tenant environments where unprivileged users can manipulate their own process mappings to influence the behavior of the system-wide profiler. No specific payload is required beyond the creation of the blocking file descriptor, making the exploitation trivial once the profiler's scan pattern is triggered.\nThe vulnerable component is the file path resolution and ELF parsing module of the eBPF agent. The issue is remediated in version 0.0.202622, which likely introduces checks (e.g., using stat or fstat) to ensure the target file is a regular file before attempting to open or parse the contents, thereby preventing the thread from entering a blocking state."
}