CVE-2025-12970: Fluent Bit Buffer Overflow Vulnerability

CVE-2025-12970 Overview

CVE-2025-12970 is a buffer overflow vulnerability in the Fluent Bit in_docker input plugin. The extract_name function copies container names into a fixed-size stack buffer without validating the length of the input. An attacker who can create containers or control container names can supply a specially crafted long name that overflows the buffer, potentially leading to process crash or arbitrary code execution.

This vulnerability represents a classic stack-based buffer overflow (CWE-120) in a widely deployed log processing and forwarding agent used extensively in cloud-native environments and Kubernetes deployments. Given Fluent Bit's prevalence in containerized infrastructure for log aggregation, successful exploitation could compromise the integrity of monitoring systems and potentially provide a foothold for further attacks within cloud environments.

Critical Impact

Attackers with container creation privileges can overflow a stack buffer to crash the Fluent Bit process or achieve arbitrary code execution, potentially compromising cloud infrastructure monitoring and enabling lateral movement.

Affected Products

• Treasuredata Fluent Bit version 4.1.0
• Earlier versions of Fluent Bit with the in_docker input plugin enabled

Discovery Timeline

• 2025-11-24 - CVE-2025-12970 published to NVD
• 2025-11-28 - Last updated in NVD database

Technical Details for CVE-2025-12970

Vulnerability Analysis

The vulnerability exists within the extract_name function of Fluent Bit's Docker input plugin (in_docker). This plugin is responsible for collecting metadata and logs from Docker containers running on the host system. When processing container information, the function extracts the container name and copies it into a stack-allocated buffer of fixed size.

The fundamental flaw is the absence of length validation before the copy operation. Container names in Docker can be up to 255 characters, but the buffer allocated on the stack may be significantly smaller. When a container with a sufficiently long name is processed, the copy operation writes beyond the buffer boundary, corrupting adjacent stack memory.

This stack corruption can overwrite critical data including saved return addresses, frame pointers, and local variables. An attacker who carefully crafts the container name payload can potentially redirect program execution to attacker-controlled code, achieving arbitrary code execution with the privileges of the Fluent Bit process.

The network attack vector is applicable because in many cloud environments, container orchestration APIs (such as the Docker API or Kubernetes API) are accessible over the network, allowing authenticated users with container creation privileges to trigger this vulnerability remotely.

Root Cause

The root cause is improper input validation (CWE-120: Buffer Copy without Checking Size of Input) in the extract_name function. The function uses an unsafe string copy operation that does not verify whether the source container name length exceeds the destination buffer capacity. This represents a failure to implement proper boundary checking, a fundamental secure coding practice for handling variable-length input data.

Attack Vector

Exploitation requires an attacker to have the ability to create containers or influence container names within the environment where Fluent Bit is monitoring Docker activity. The attack proceeds as follows:

1. The attacker creates a Docker container with a maliciously crafted long name designed to overflow the stack buffer
2. Fluent Bit's in_docker plugin polls Docker for container information and processes the malicious container
3. The extract_name function copies the oversized name into the fixed-size stack buffer
4. The buffer overflow corrupts stack memory, potentially overwriting the return address
5. Depending on exploitation sophistication, this results in either a denial of service (crash) or arbitrary code execution

In cloud environments with shared infrastructure, an attacker with legitimate but limited container privileges could exploit this vulnerability to escalate access or disrupt logging and monitoring capabilities.

Detection Methods for CVE-2025-12970

Indicators of Compromise

• Unexpected Fluent Bit process crashes or restarts, particularly when new containers are created
• Docker containers with unusually long names (approaching or exceeding typical limits)
• Core dumps from Fluent Bit processes showing stack corruption patterns
• Anomalous container creation patterns from unexpected sources

Detection Strategies

• Monitor Fluent Bit process stability and investigate frequent crashes or unexpected terminations
• Implement container name length validation policies in container orchestration platforms
• Deploy runtime security tools to detect stack buffer overflow exploitation attempts
• Audit container creation events for anomalous naming patterns or unauthorized sources

Monitoring Recommendations

• Enable process monitoring for Fluent Bit instances to detect crashes and abnormal behavior
• Configure alerting on container creation events with names exceeding normal length thresholds
• Review Docker API access logs for unusual container creation requests
• Implement centralized logging for Fluent Bit health metrics and error conditions

How to Mitigate CVE-2025-12970

Immediate Actions Required

• Upgrade Fluent Bit to version 4.1.1 or later which addresses this vulnerability
• If immediate patching is not possible, disable the in_docker input plugin if not required
• Restrict container creation privileges to trusted users and service accounts
• Implement container admission policies to enforce reasonable name length limits

Patch Information

Treasuredata has addressed this vulnerability in Fluent Bit. According to the Fluent Bit Security Vulnerabilities Patch, fixes have been implemented in version 4.1 and backported to the 4.0 branch. Organizations should upgrade to the latest patched version as soon as possible. Additional technical analysis is available from Oligo Security's research on critical Fluent Bit vulnerabilities.

Workarounds

• Disable the in_docker input plugin by removing or commenting out the relevant configuration section if Docker container monitoring is not essential
• Implement network segmentation to restrict access to Docker API endpoints
• Use admission controllers in Kubernetes environments to enforce container name length policies
• Deploy application-level firewall rules to filter requests with excessively long container names

# Disable in_docker plugin in Fluent Bit configuration
# Comment out or remove the [INPUT] section for docker
# Example fluent-bit.conf modification:

# [INPUT]
#     Name   docker
#     Tag    docker.*

# Alternative: Restrict Docker API access
# Ensure Docker socket is not exposed over network without authentication
chmod 660 /var/run/docker.sock