4 results · Feed
-
Unscored —
`EbpfVm::invoke_function` performs out-of-bounds pointer arithmetic
Affected versions of `solana_rbpf` expose the safe method `EbpfVm::invoke_function`. This method computes an obfuscated VM pointer by casting `self` to `*mut u64` and applying a randomized offset derived from `get_runtime_environment_key()`. The resulting poi…
-
High 7.5
Integer overflow in solana_rbpf
Solana solana_rbpf before 0.2.29 has an addition integer overflow via invalid ELF program headers. elf.rs has a panic via a malformed eBPF program.
-
Critical 9.1
Solana rBPF - Incorrect Calculation in sdiv instruction
In Solana rBPF versions 0.2.26 and 0.2.27 are affected by Incorrect Calculation which is caused by improper implementation of sdiv instruction. This can lead to the wrong execution path, resulting in huge loss in specific cases. For example, the result of a s…
-
High 7.5
Integer overflow in solana_rbpf
From version 0.2.14 to 0.2.16 for Solana rBPF, function "relocate" in the file src/elf.rs has an integer overflow bug because the sym.st_value is read directly from ELF file without checking. If the sym.st_value is rather large, an integer overflow is trigger…