Vulnerability-Lookup

CVE-2026-44778 (GCVE-0-2026-44778)

Vulnerability from cvelistv5 – Published: 2026-09-15 17:00 – Updated: 2026-09-17 16:19

Title

Inspektor Gadget: Unprivileged container can crash USDT note parser via crafted ELF

Summary

Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. From 0.28.0 until 0.53.1, the USDT note parser in pkg/uprobetracer/usdt.go can allow an unprivileged container to crash or exhaust the memory of the privileged Inspektor Gadget process when a custom gadget containing a SEC("usdt/...") eBPF section attaches to a crafted ELF binary. The getUsdtInfo() function reads the .note.stapsdt section without validating that DescSize is large enough for three address fields, allowing an out-of-bounds slice operation to panic, and it uses untrusted NameSize and DescSize values for allocations that can consume gigabytes of memory. The parser also invokes debug/elf without panic recovery, allowing other malformed ELF structures to terminate the process. No gadget shipped by Inspektor Gadget uses USDT probes, so only deployments using custom USDT gadgets are affected, and the demonstrated impact is denial of service rather than code execution or privilege escalation. This issue is fixed in version 0.53.1.

Severity

2.9 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-17 16:19 UTC

CWE

CWE-20 - Improper Input Validation

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7868 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/inspektor-gadget/inspektor-gad…	x_refsource_CONFIRM
https://github.com/inspektor-gadget/inspektor-gad…	x_refsource_MISC
https://github.com/inspektor-gadget/inspektor-gad…	x_refsource_MISC
https://github.com/inspektor-gadget/inspektor-gad…	x_refsource_MISC
https://github.com/inspektor-gadget/inspektor-gad…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
inspektor-gadget	inspektor-gadget	Affected: >= 0.28.0, < 0.53.1	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44778",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T16:19:10.942625Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T16:19:41.631Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "inspektor-gadget",
          "vendor": "inspektor-gadget",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.28.0, \u003c 0.53.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. From 0.28.0 until 0.53.1, the USDT note parser in pkg/uprobetracer/usdt.go can allow an unprivileged container to crash or exhaust the memory of the privileged Inspektor Gadget process when a custom gadget containing a SEC(\"usdt/...\") eBPF section attaches to a crafted ELF binary. The getUsdtInfo() function reads the .note.stapsdt section without validating that DescSize is large enough for three address fields, allowing an out-of-bounds slice operation to panic, and it uses untrusted NameSize and DescSize values for allocations that can consume gigabytes of memory. The parser also invokes debug/elf without panic recovery, allowing other malformed ELF structures to terminate the process. No gadget shipped by Inspektor Gadget uses USDT probes, so only deployments using custom USDT gadgets are affected, and the demonstrated impact is denial of service rather than code execution or privilege escalation. This issue is fixed in version 0.53.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.9,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T17:00:45.272Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/inspektor-gadget/inspektor-gadget/security/advisories/GHSA-7cfq-5mhv-jrp9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/inspektor-gadget/inspektor-gadget/security/advisories/GHSA-7cfq-5mhv-jrp9"
        },
        {
          "name": "https://github.com/inspektor-gadget/inspektor-gadget/pull/5547",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/inspektor-gadget/inspektor-gadget/pull/5547"
        },
        {
          "name": "https://github.com/inspektor-gadget/inspektor-gadget/commit/27263e50d6287891eee4d9a1cfae62681260e1a2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/inspektor-gadget/inspektor-gadget/commit/27263e50d6287891eee4d9a1cfae62681260e1a2"
        },
        {
          "name": "https://github.com/inspektor-gadget/inspektor-gadget/commit/aaffacc6a9e43b4de5ce8f8148e6c2d9a1ea6026",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/inspektor-gadget/inspektor-gadget/commit/aaffacc6a9e43b4de5ce8f8148e6c2d9a1ea6026"
        },
        {
          "name": "https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.53.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.53.1"
        }
      ],
      "source": {
        "advisory": "GHSA-7cfq-5mhv-jrp9",
        "discovery": "UNKNOWN"
      },
      "title": "Inspektor Gadget: Unprivileged container can crash USDT note parser via crafted ELF"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-44778",
    "datePublished": "2026-09-15T17:00:33.252Z",
    "dateReserved": "2026-05-07T19:20:44.689Z",
    "dateUpdated": "2026-09-17T16:19:41.631Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-44778",
      "date": "2026-11-15",
      "epss": "0.0063",
      "percentile": "0.5075"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "inspektor-gadget",
                "vendor": "inspektor-gadget",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 0.28.0, \u003c 0.53.1"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. From 0.28.0 until 0.53.1, the USDT note parser in pkg/uprobetracer/usdt.go can allow an unprivileged container to crash or exhaust the memory of the privileged Inspektor Gadget process when a custom gadget containing a SEC(\"usdt/...\") eBPF section attaches to a crafted ELF binary. The getUsdtInfo() function reads the .note.stapsdt section without validating that DescSize is large enough for three address fields, allowing an out-of-bounds slice operation to panic, and it uses untrusted NameSize and DescSize values for allocations that can consume gigabytes of memory. The parser also invokes debug/elf without panic recovery, allowing other malformed ELF structures to terminate the process. No gadget shipped by Inspektor Gadget uses USDT probes, so only deployments using custom USDT gadgets are affected, and the demonstrated impact is denial of service rather than code execution or privilege escalation. This issue is fixed in version 0.53.1."
          }
        ],
        "id": "CVE-2026-44778",
        "lastModified": "2026-09-30T17:43:24.057",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 2.9,
                "baseSeverity": "LOW",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "PROOF_OF_CONCEPT",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "LOW",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-44778",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T16:19:10.942625Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-15T17:17:14.970",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/inspektor-gadget/inspektor-gadget/commit/27263e50d6287891eee4d9a1cfae62681260e1a2"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/inspektor-gadget/inspektor-gadget/commit/aaffacc6a9e43b4de5ce8f8148e6c2d9a1ea6026"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/inspektor-gadget/inspektor-gadget/pull/5547"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.53.1"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/inspektor-gadget/inspektor-gadget/security/advisories/GHSA-7cfq-5mhv-jrp9"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-20"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-09-15T20:15:01+00:00",
      "cve": "CVE-2026-44778",
      "id": "CVE-2026-44778",
      "initial_release_date": "2026-09-15T17:00:33.252000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "github.com/inspektor-gadget/inspektor-gadget: Inspektor Gadget: Denial of Service via crafted ELF binary",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44778.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-44778",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-17T16:19:10.942625Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-17T16:19:34.459Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "inspektor-gadget",
              "vendor": "inspektor-gadget",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 0.28.0, \u003c 0.53.1"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. From 0.28.0 until 0.53.1, the USDT note parser in pkg/uprobetracer/usdt.go can allow an unprivileged container to crash or exhaust the memory of the privileged Inspektor Gadget process when a custom gadget containing a SEC(\"usdt/...\") eBPF section attaches to a crafted ELF binary. The getUsdtInfo() function reads the .note.stapsdt section without validating that DescSize is large enough for three address fields, allowing an out-of-bounds slice operation to panic, and it uses untrusted NameSize and DescSize values for allocations that can consume gigabytes of memory. The parser also invokes debug/elf without panic recovery, allowing other malformed ELF structures to terminate the process. No gadget shipped by Inspektor Gadget uses USDT probes, so only deployments using custom USDT gadgets are affected, and the demonstrated impact is denial of service rather than code execution or privilege escalation. This issue is fixed in version 0.53.1."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "baseScore": 2.9,
                "baseSeverity": "LOW",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
                "version": "4.0",
                "vulnAvailabilityImpact": "LOW",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-20",
                  "description": "CWE-20: Improper Input Validation",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-15T17:00:45.272Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/inspektor-gadget/inspektor-gadget/security/advisories/GHSA-7cfq-5mhv-jrp9",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/inspektor-gadget/inspektor-gadget/security/advisories/GHSA-7cfq-5mhv-jrp9"
            },
            {
              "name": "https://github.com/inspektor-gadget/inspektor-gadget/pull/5547",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/inspektor-gadget/inspektor-gadget/pull/5547"
            },
            {
              "name": "https://github.com/inspektor-gadget/inspektor-gadget/commit/27263e50d6287891eee4d9a1cfae62681260e1a2",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/inspektor-gadget/inspektor-gadget/commit/27263e50d6287891eee4d9a1cfae62681260e1a2"
            },
            {
              "name": "https://github.com/inspektor-gadget/inspektor-gadget/commit/aaffacc6a9e43b4de5ce8f8148e6c2d9a1ea6026",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/inspektor-gadget/inspektor-gadget/commit/aaffacc6a9e43b4de5ce8f8148e6c2d9a1ea6026"
            },
            {
              "name": "https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.53.1",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.53.1"
            }
          ],
          "source": {
            "advisory": "GHSA-7cfq-5mhv-jrp9",
            "discovery": "UNKNOWN"
          },
          "title": "Inspektor Gadget: Unprivileged container can crash USDT note parser via crafted ELF"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-44778",
        "datePublished": "2026-09-15T17:00:33.252Z",
        "dateReserved": "2026-05-07T19:20:44.689Z",
        "dateUpdated": "2026-09-17T16:19:41.631Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-44778

Vulnerability from fkie_nvd - Published: 2026-09-15 17:17 - Updated: 2026-09-30 17:43

Severity

2.9 (Low) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/inspektor-gadget/inspektor-gadget/commit/27263e50d6287891eee4d9a1cfae62681260e1a2
	security-advisories@github.com	https://github.com/inspektor-gadget/inspektor-gadget/commit/aaffacc6a9e43b4de5ce8f8148e6c2d9a1ea6026
	security-advisories@github.com	https://github.com/inspektor-gadget/inspektor-gadget/pull/5547
	security-advisories@github.com	https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.53.1
	security-advisories@github.com	https://github.com/inspektor-gadget/inspektor-gadget/security/advisories/GHSA-7cfq-5mhv-jrp9

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "inspektor-gadget",
          "vendor": "inspektor-gadget",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.28.0, \u003c 0.53.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. From 0.28.0 until 0.53.1, the USDT note parser in pkg/uprobetracer/usdt.go can allow an unprivileged container to crash or exhaust the memory of the privileged Inspektor Gadget process when a custom gadget containing a SEC(\"usdt/...\") eBPF section attaches to a crafted ELF binary. The getUsdtInfo() function reads the .note.stapsdt section without validating that DescSize is large enough for three address fields, allowing an out-of-bounds slice operation to panic, and it uses untrusted NameSize and DescSize values for allocations that can consume gigabytes of memory. The parser also invokes debug/elf without panic recovery, allowing other malformed ELF structures to terminate the process. No gadget shipped by Inspektor Gadget uses USDT probes, so only deployments using custom USDT gadgets are affected, and the demonstrated impact is denial of service rather than code execution or privilege escalation. This issue is fixed in version 0.53.1."
    }
  ],
  "id": "CVE-2026-44778",
  "lastModified": "2026-09-30T17:43:24.057",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 2.9,
          "baseSeverity": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "LOW",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-44778",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-17T16:19:10.942625Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-15T17:17:14.970",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/inspektor-gadget/inspektor-gadget/commit/27263e50d6287891eee4d9a1cfae62681260e1a2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/inspektor-gadget/inspektor-gadget/commit/aaffacc6a9e43b4de5ce8f8148e6c2d9a1ea6026"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/inspektor-gadget/inspektor-gadget/pull/5547"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.53.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/inspektor-gadget/inspektor-gadget/security/advisories/GHSA-7cfq-5mhv-jrp9"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-7CFQ-5MHV-JRP9

Vulnerability from github – Published: 2026-06-22 20:35 – Updated: 2026-06-22 20:35

Summary

Inspektor Gadget: Unprivileged container can crash USDT note parser via crafted ELF (no shipped gadget affected)

Details

Summary

A malicious container can crash or destabilize the privileged Inspektor Gadget process when a gadget using USDT probes is deployed. The vulnerability is in the USDT note parser (pkg/uprobetracer/usdt.go) which is invoked when a gadget with a SEC("usdt/...") section attaches to a target binary. An unprivileged process can place a crafted ELF binary at the expected library path, triggering one of two attack vectors:

Panic (immediate crash): A stapsdt note with a small DescSize causes an out-of-bounds slice access, panicking the IG process.
Memory exhaustion (OOM kill): A stapsdt note with a very large NameSize or DescSize causes IG to allocate up to ~4 GiB of memory, which can killnthe process if deployed with memory restrictions (e.g., cgroup limits).

Important: The vulnerability is only triggered when running a gadget that uses USDT probes (i.e., contains a SEC("usdt/...") eBPF section). No gadget shipped by the Inspektor Gadget project uses USDT today. Users who deploy their own custom USDT gadgets are affected.

Severity

Low — Denial of Service (process crash or OOM) of a privileged host process, triggered by an unprivileged container. The vulnerable code path is only reached when a gadget using USDT probes is deployed. No such gadget is shipped by the Inspektor Gadget project; only users running custom USDT gadgets are affected.

Attack vector: An unprivileged process in a container places a crafted ELF file at a path that a USDT gadget targets (e.g., a library name resolved via the container's ld cache). When the gadget attaches, IG parses the malicious ELF and crashes.
Impact: The IG process panics and crashes (vector 1) or is OOM-killed (vector 2). This is a DoS against the monitoring infrastructure, not a code execution or privilege escalation vulnerability.
Affected component: pkg/uprobetracer/usdt.go, function getUsdtInfo()
Prerequisites: A gadget with a SEC("usdt/...") eBPF section must be running and configured to attach to a library inside the attacker's container. No shipped gadgets use USDT probes, so this only affects deployments with custom USDT gadgets.

Affected Versions

All versions of Inspektor Gadget that include USDT support in pkg/uprobetracer/usdt.go, starting from v0.28.0 (commit 7ee5e7a90 "pkg/uprobetracer: support USDT trace points").

Root Cause

Vector 1: Out-of-bounds slice access (panic)

In pkg/uprobetracer/usdt.go, the function getUsdtInfo() parses stapsdt notes from an ELF file's .note.stapsdt section. When a matching note is found (name == "stapsdt\0" and type == 3), it reads three address fields from the note descriptor:

// usdt.go lines 137-139
elfLocation := elfReader.ByteOrder.Uint64(desc[:wordSize])
elfBase := elfReader.ByteOrder.Uint64(desc[wordSize : 2*wordSize])
elfSemaphore := elfReader.ByteOrder.Uint64(desc[2*wordSize : 3*wordSize])

For a 64-bit ELF, wordSize = 8, so this requires desc to be at least 24 bytes. However, desc is allocated based on the note's DescSize field from the ELF file:

desc := make([]byte, alignUp(uint64(header.DescSize), 4))

A crafted ELF with DescSize = 1 produces a 4-byte desc buffer. The expression desc[:8] then panics with:

panic: runtime error: slice bounds out of range [:8] with capacity 4

Vector 2: Unbounded memory allocation (OOM)

The NameSize and DescSize fields from the note header are used directly to allocate memory without any upper bound:

name := make([]byte, alignUp(uint64(header.NameSize), 4))
desc := make([]byte, alignUp(uint64(header.DescSize), 4))

A crafted ELF with NameSize = 0xFFFFFFFF would attempt to allocate ~4 GiB of memory. Under cgroup memory limits (common in Kubernetes deployments), this triggers an OOM kill of the IG process.

Vector 3: Missing panic recovery for `debug/elf`

Go's debug/elf package is not hardened against adversarial inputs and may panic on malformed ELF headers. The cilium/ebpf library addresses this with its SafeELFFile wrapper that uses recover(), but getUsdtInfo() calls elf.NewFile() directly without any panic recovery.

Fix

The fix (3 changes in pkg/uprobetracer/usdt.go):

Bounds check on descriptor size: Validate len(desc) >= 3*wordSize before accessing the address fields. Reject malformed notes with an error instead of panicking.
Cap allocation sizes: Limit NameSize and DescSize to a reasonable maximum (1 MiB) before allocating memory, preventing DoS via memory exhaustion. There is no standard upper bound for ELF note fields; 1 MiB is a generous arbitrary cap — legitimate USDT notes are typically under 1 KB.
Panic recovery: Wrap getUsdtInfo() with defer/recover to catch any panics from debug/elf on malformed input, converting them to errors.

Go debug/elf known issues: https://github.com/golang/go/issues?q=is%3Aissue+is%3Aopen+debug%2Felf+in%3Atitle
cilium/ebpf SafeELFFile wrapper: https://github.com/cilium/ebpf/blob/main/internal/safeelf.go — uses recover() around all debug/elf operations for exactly this reason.

Severity

2.9 (Low)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/inspektor-gadget/inspektor-gadget"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.28.0"
            },
            {
              "fixed": "0.53.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44778"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-22T20:35:42Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "## Summary\n\nA malicious container can crash or destabilize the privileged Inspektor Gadget process when a **gadget using USDT probes** is deployed. The vulnerability is in the USDT note parser (`pkg/uprobetracer/usdt.go`) which is invoked when a gadget with a `SEC(\"usdt/...\")` section attaches to a target binary. An unprivileged process can place a crafted ELF binary at the expected library path, triggering one of two attack vectors:\n\n1. **Panic (immediate crash):** A stapsdt note with a small `DescSize` causes an out-of-bounds slice access, panicking the IG process.\n2. **Memory exhaustion (OOM kill):** A stapsdt note with a very large `NameSize` or `DescSize` causes IG to allocate up to ~4 GiB of memory, which can killnthe process if deployed with memory restrictions (e.g., cgroup limits).\n\n**Important:** The vulnerability is only triggered when running a gadget that uses USDT probes (i.e., contains a `SEC(\"usdt/...\")` eBPF section). No gadget shipped by the Inspektor Gadget project uses USDT today. Users who deploy their own custom USDT gadgets are affected.\n\n## Severity\n\n**Low** \u2014 Denial of Service (process crash or OOM) of a privileged host process, triggered by an unprivileged container. The vulnerable code path is only reached when a gadget using USDT probes is deployed. No such gadget is shipped by the Inspektor Gadget project; only users running custom USDT gadgets are affected.\n\n- **Attack vector**: An unprivileged process in a container places a crafted ELF  file at a path that a USDT gadget targets (e.g., a library name resolved via the container\u0027s ld cache). When the gadget attaches, IG parses the malicious ELF and crashes.\n- **Impact**: The IG process panics and crashes (vector 1) or is OOM-killed (vector 2). This is a DoS against the monitoring infrastructure, not a code execution or privilege escalation vulnerability.\n- **Affected component**: `pkg/uprobetracer/usdt.go`, function `getUsdtInfo()`\n- **Prerequisites**: A gadget with a `SEC(\"usdt/...\")` eBPF section must be running and configured to attach to a library inside the attacker\u0027s container.\n  **No shipped gadgets use USDT probes**, so this only affects deployments with custom USDT gadgets.\n\n## Affected Versions\n\nAll versions of Inspektor Gadget that include USDT support in `pkg/uprobetracer/usdt.go`, starting from v0.28.0 (commit 7ee5e7a90 \"pkg/uprobetracer: support USDT trace points\").\n\n## Root Cause\n\n### Vector 1: Out-of-bounds slice access (panic)\n\nIn `pkg/uprobetracer/usdt.go`, the function `getUsdtInfo()` parses stapsdt notes from an ELF file\u0027s `.note.stapsdt` section. When a matching note is found (`name == \"stapsdt\\0\"` and `type == 3`), it reads three address fields from the note descriptor:\n\n```go\n// usdt.go lines 137-139\nelfLocation := elfReader.ByteOrder.Uint64(desc[:wordSize])\nelfBase := elfReader.ByteOrder.Uint64(desc[wordSize : 2*wordSize])\nelfSemaphore := elfReader.ByteOrder.Uint64(desc[2*wordSize : 3*wordSize])\n```\n\nFor a 64-bit ELF, `wordSize = 8`, so this requires `desc` to be at least 24 bytes. However, `desc` is allocated based on the note\u0027s `DescSize` field from the ELF file:\n\n```go\ndesc := make([]byte, alignUp(uint64(header.DescSize), 4))\n```\n\nA crafted ELF with `DescSize = 1` produces a 4-byte `desc` buffer. The expression `desc[:8]` then panics with:\n\n```\npanic: runtime error: slice bounds out of range [:8] with capacity 4\n```\n\n### Vector 2: Unbounded memory allocation (OOM)\n\nThe `NameSize` and `DescSize` fields from the note header are used directly to allocate memory without any upper bound:\n\n```go\nname := make([]byte, alignUp(uint64(header.NameSize), 4))\ndesc := make([]byte, alignUp(uint64(header.DescSize), 4))\n```\n\nA crafted ELF with `NameSize = 0xFFFFFFFF` would attempt to allocate ~4 GiB of memory. Under cgroup memory limits (common in Kubernetes deployments), this triggers an OOM kill of the IG process.\n\n### Vector 3: Missing panic recovery for `debug/elf`\n\nGo\u0027s `debug/elf` package is [not hardened against adversarial inputs](https://github.com/golang/go/issuesq=is%3Aissue+is%3Aopen+debug%2Felf+in%3Atitle) and may panic on malformed ELF headers. The cilium/ebpf library addresses this with its [`SafeELFFile` wrapper](https://github.com/cilium/ebpf/blob/main/internal/safeelf.go) that uses `recover()`, but `getUsdtInfo()` calls `elf.NewFile()` directly without any panic recovery.\n\n## Fix\n\nThe fix (3 changes in `pkg/uprobetracer/usdt.go`):\n\n1. **Bounds check on descriptor size**: Validate `len(desc) \u003e= 3*wordSize` before accessing the address fields. Reject malformed notes with an error instead of panicking.\n\n2. **Cap allocation sizes**: Limit `NameSize` and `DescSize` to a reasonable maximum (1 MiB) before allocating memory, preventing DoS via memory exhaustion. There is no standard upper bound for ELF note fields; 1 MiB is a generous arbitrary cap \u2014 legitimate USDT notes are typically under 1 KB.\n\n3. **Panic recovery**: Wrap `getUsdtInfo()` with `defer/recover` to catch any panics from `debug/elf` on malformed input, converting them to errors.\n\n## Related\n\n- Go `debug/elf` known issues: https://github.com/golang/go/issues?q=is%3Aissue+is%3Aopen+debug%2Felf+in%3Atitle\n- cilium/ebpf `SafeELFFile` wrapper: https://github.com/cilium/ebpf/blob/main/internal/safeelf.go \u2014 uses `recover()` around all `debug/elf` operations for exactly this reason.",
  "id": "GHSA-7cfq-5mhv-jrp9",
  "modified": "2026-06-22T20:35:42Z",
  "published": "2026-06-22T20:35:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/inspektor-gadget/inspektor-gadget/security/advisories/GHSA-7cfq-5mhv-jrp9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/inspektor-gadget/inspektor-gadget/pull/5547"
    },
    {
      "type": "WEB",
      "url": "https://github.com/inspektor-gadget/inspektor-gadget/commit/ec69da2e00c39bc43f389f943899e5ff9c7b011a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/inspektor-gadget/inspektor-gadget"
    },
    {
      "type": "WEB",
      "url": "https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.53.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Inspektor Gadget: Unprivileged container can crash USDT note parser via crafted ELF (no shipped gadget affected)"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-44778 (GCVE-0-2026-44778)

FKIE_CVE-2026-44778

GHSA-7CFQ-5MHV-JRP9

Summary

Severity

Affected Versions

Root Cause

Vector 1: Out-of-bounds slice access (panic)

Vector 2: Unbounded memory allocation (OOM)

Vector 3: Missing panic recovery for debug/elf

Fix

Related

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour

Vector 3: Missing panic recovery for `debug/elf`