libbpf vulnerabilities

A buffer overflow vulnerability in libbpf 1.5.0 allows a local attacker to execute arbitrary code via the bpf_object__init_prog function of libbpf. This has been disputed by third parties who assert that no one in their sane mind should be passing untrusted ELF files into libbpf while running under root.

In libbpf, the signed loader does not ensure that a map is exclusive before validating map->sha. Without exclusivity, another BPF program with map access can mutate the contents after freezing, allowing validation on stale data. The fix adds an exclusivity check.

In the libbpf library in the Linux kernel, a size overflow issue was found when mapping ringbuf memory. The maximum ringbuf size on x86-64 hosts is 2GB, so 2 * max_entries can overflow u32 when mapping producer and data pages. The fix casts the size of the read-only mmap region to __u64 and checks for overflow during mmap.