A critical stack-based buffer overflow in Fluent Bit, specifically within the in_docker input plugin, allows authenticated attackers to execute arbitrary code or crash the service.

This is a stack-based buffer overflow (CWE-121) occurring in the extract_name function. An attacker with low privileges who can influence container names can supply excessively long strings that overflow the stack buffer, leading to remote code execution or denial of service.

The ability to execute arbitrary code via a buffer overflow poses a significant risk to the integrity and availability of log processing infrastructure. Given the CVSS score of 8.8, this vulnerability could allow an attacker to gain control over systems that aggregate sensitive logs, potentially leading to data exfiltration or total system compromise.

Immediate Action: Upgrade Fluent Bit to version 4.0.12 or later to address the vulnerable extract_name function.

Proactive Monitoring: Monitor system logs for unexpected process crashes or segmentation faults within the Fluent Bit service that may indicate failed or successful exploitation attempts.

Compensating Controls: Restrict the ability of untrusted users or processes to influence container naming conventions within the environment to limit the attack surface.

Public Exploit Available: Unknown

The severity of this vulnerability necessitates immediate attention, particularly in cloud-native environments where Fluent Bit is deployed to process container logs. Organizations should prioritize patching to version 4.0.12 across all affected clusters to eliminate the risk of arbitrary code execution.