CVE-2021-46102: Integer overflow in solana_rbpf
(updated )
From version 0.2.14 to 0.2.16 for Solana rBPF, function “relocate” in the file src/elf.rs has an integer overflow bug because the sym.st_value is read directly from ELF file without checking. If the sym.st_value is rather large, an integer overflow is triggered while calculating the variable “addr” via addr = (sym.st_value + refd_pa) as u64
References
- blocksecteam.medium.com/new-integer-overflow-bug-discovered-in-solana-rbpf-7729717159ee
- github.com/advisories/GHSA-xwqr-xmgg-j69q
- github.com/solana-labs/rbpf
- github.com/solana-labs/rbpf/blob/c14764850f0b83b58aa013248eaf6d65836c1218/src/elf.rs
- github.com/solana-labs/rbpf/pull/200
- github.com/solana-labs/rbpf/pull/236
- github.com/solana-labs/rbpf/releases/tag/v0.2.17
- nvd.nist.gov/vuln/detail/CVE-2021-46102
Code Behaviors & Features
Detect and mitigate CVE-2021-46102 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →