Re: Responsible Disclosure: Heap Out-of-Bounds Write via Integer Underflow in libbpf parse_cpu_mask_str() (libbpf.c:14446)

[John Fastabend <john.fastabend@gmail.com>]

On Fri, Jul 03, 2026 at 05:22:30PM +0500, Vuln seeker Cyber Security Team wrote:
>Dear libbpf Security Team,

[...]

>libbpf's CPU mask parser. An integer underflow in parse_cpu_mask_str()
>causes a memset to write far past a shrunk heap allocation, reachable
>end-to-end through the public libbpf_num_possible_cpus() API.

Send the fix seems worth checking to me if we are already checking
start/end. If some app is exposing user input to this then I would
push a report to them.

[...]

>  - Any downstream consumer that feeds untrusted CPU-mask strings to 
>  the
>internal parse_cpu_mask_str helper directly


Not sure why untrusted input is getting here but sure if someone
is piping user input to libbpf let them know. I think if you have
untrusted user input hitting libbpf you have bigger problems.

[...]

>
>  if (start < *mask_sz)
>      return -EINVAL;  // "CPU range out of order or overlapping"
>

Send a fix. Thanks.