GHSA-43g7-cwr8-q3jh OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI

• Go go.opentelemetry.io/obi: >= 0.7.0, < 0.9.0 → fixed in 0.9.0

Summary A remotely reachable integer overflow in OBI's memcached text protocol parser can crash the OBI process and cause denial of service. When parsing memcached storage commands such as `set`, `add`, `replace`, `append`, `prepend`, or `cas`, OBI accepts extremely large `` values and adds the payload delimiter length without checking for overflow. A crafted request with `` set to `math.MaxInt` or `math.MaxInt-1` causes the computed payload length to wrap negative and triggers a runtime panic in `LargeBufferReader.Peek`. Details The issue is in the memcached request parser at `pkg/ebpf/common/memcached_detect_transform.go`. `memcachedCommandBytesField` parses the storage command `` field with `strconv.Atoi` and only rejects negative values: ```go size, err := strconv.Atoi(string(fields[4])) if err != nil || size Remaining()` but does not reject negative values before slicing: ```go if r.rchunk ` field as an `int`, and computes: ```go payloadLen = bytesField + len("\r\n") ``` 5. That addition overflows negative and the negative `payloadLen` is passed to `LargeBufferReader.Peek`, which slices with an invalid bound and panics. 6. Confirm the crash by checking the `autoinstrumenter` container status or logs: ```bash docker compose \ -f internal/test/oats/memcached/docker-compose-include-base.yml \ -f internal/test/oats/memcached/docker-compose-obi-python-memcached.yml \ ps autoinstrumenter ``` ```bash docker compose \ -f internal/test/oats/memcached/docker-compose-include-base.yml \ -f internal/test/oats/memcached/docker-compose-obi-python-memcached.yml \ logs autoinstrumenter ``` The expected result is that the OBI process crashes with a panic originating from `LargeBufferReader.Peek`, with the call path including `memcachedConsumeStoragePayload`. Impact This is a remote denial-of-service vulnerability in OBI's memcached protocol parsing path. Impacted deployments are those where: • OBI is running with the vulnerable memcached parser, and • OBI observes memcached text protocol traffic from applications or services that an attacker can reach or influence. A successful attack does not require code execution or authentication against OBI itself. An attacker only needs to cause a vulnerable instrumented service to emit or receive a crafted memcached storage command. The result is a panic in OBI and loss of telemetry collection until the process is restarted.