GitHub Advisoryadvisory · crates.io

GHSA-xwqr-xmgg-j69q Integer overflow in solana_rbpf

HIGH Published 2022-01-28 Modified 2023-04-26 Official page ↗
Aliases
CVE-2021-46102
Ecosystem
crates.io
Packages
solana_rbpf
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-190
Reviewed
2022-01-28

Affected packages

• crates.io solana_rbpf: >= 0.2.14, < 0.2.17 → fixed in 0.2.17

Description

From version 0.2.14 to 0.2.16 for Solana rBPF, function "relocate" in the file src/elf.rs has an integer overflow bug because the sym.st_value is read directly from ELF file without checking. If the sym.st_value is rather large, an integer overflow is triggered while calculating the variable "addr" via `addr = (sym.st_value + refd_pa) as u64`

Related

Alias · CVE (1)

  • CVE-2021-46102 From version 0.2.14 to 0.2.16 for Solana rBPF, function "relocate" in the file src/elf.rs has an integer overflow bug because the… vulnerability

Weakness · CWE (1)

  • CWE-190 Integer Overflow or Wraparound weakness

References