GitHub Advisoryadvisory · crates.io

GHSA-9qmm-4mfr-r3wj Incorrect Calculation in solana_rbpf

CRITICAL Published 2022-05-10 Modified 2022-05-24 Official page ↗
Aliases
CVE-2022-23066
Ecosystem
crates.io
Packages
solana_rbpf
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Weaknesses
CWE-682
Reviewed
2022-05-24

Affected packages

• crates.io solana_rbpf: >= 0.2.26, < 0.2.28 → fixed in 0.2.28

Description

In Solana rBPF versions 0.2.26 and 0.2.27 are affected by Incorrect Calculation which is caused by improper implementation of sdiv instruction. This can lead to the wrong execution path, resulting in huge loss in specific cases. For example, the result of a sdiv instruction may decide whether to transfer tokens or not. The vulnerability affects both integrity and may cause serious availability problems.

Related

Alias · CVE (1)

  • CVE-2022-23066 In Solana rBPF versions 0.2.26 and 0.2.27 are affected by Incorrect Calculation which is caused by improper implementation of sdiv… vulnerability

Weakness · CWE (1)

  • CWE-682 Incorrect Calculation weakness

References