Skip to content

GHSA-2hqh-5c36-grrm on CTRL-OS 26.05

Aliases: GHSA-2hqh-5c36-grrm

Packages: libseccomp

Status: Plausible

Advisory Information

Impact

libseccomp contains an integer overflow risk in seccomp BPF generation. The internal struct bpf_program.blk_cnt field is a uint16_t. When an unusually large filter generates more than 65,535 BPF instructions, the count can wrap and lead to heap corruption, including a double-free.

Applications that compile attacker-controlled or otherwise untrusted seccomp profiles are impacted. This is most relevant to container runtimes, sandbox managers, or privileged services that build seccomp filters on behalf of less-trusted users.

Patches

The issue has been patched by rejecting oversized generated BPF programs before blk_cnt can overflow, returning -E2BIG.

Users should upgrade to libseccomp release v2.6.1 or greater, or apply the patch/backport containing the following commit: 

commit dc9fcd66d0c282a698f1f036a9af61c9aae967eb
Author: Paul Moore <paul@paul-moore.com>
Date:   Mon Jun 22 17:07:22 2026 -0400

    bpf: protect against addition overflows when building the filter
    
    Add overflow detection code to the various code paths that allocate and
    build the BPF seccomp filter to ensure that excessively large filters
    do not cause problems during filter generation time.
    
    Reported-by: Feng Xue w/XGPT (ThreatBook) <feng.xue@outlook.com>
    Reviewed-by: Tom Hromatka (Oracle) <tom.hromatka@gmail.com>
    Tested-by: Tom Hromatka (Oracle) <tom.hromatka@gmail.com>
    Tested-by: Feng Xue w/XGPT (ThreatBook) <feng.xue@outlook.com>
    Signed-off-by: Paul Moore <paul@paul-moore.com>
    (imported from commit 2d6cf62b780e5c66c4073fc9920543276f7a3575)

Workarounds

Applications can mitigate this issue by enforcing limits on untrusted seccomp profiles before passing them to libseccomp. In particular, reject unusually large profiles or profiles that may generate tens of thousands of BPF instructions.

Avoid compiling untrusted seccomp profiles in privileged processes unless strict rule or generated-instruction limits are enforced.

References

  • Project: https://github.com/seccomp/libseccomp
  • Affected code: src/gen_bpf.c, src/gen_bpf.h, src/helper.c
  • Patch: https://github.com/seccomp/libseccomp/commit/dc9fcd66d0c282a698f1f036a9af61c9aae967eb

Credits

Reported by Feng Xue w/XGPT (ThreatBook).

Updates

2026-07-15 16:01 CEST

Metadata changes:

  • Status for package libseccomp: “Plausible”

2026-07-15 16:00 CEST

Metadata changes:

  • Status for package libseccomp: “New”