GHSA-xwqr-xmgg-j69q

Suggest an improvement
Source
https://github.com/advisories/GHSA-xwqr-xmgg-j69q
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-xwqr-xmgg-j69q/GHSA-xwqr-xmgg-j69q.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-xwqr-xmgg-j69q
Aliases
Published
2022-01-28T22:59:28Z
Modified
2023-11-08T04:07:25Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Integer overflow in solana_rbpf
Details

From version 0.2.14 to 0.2.16 for Solana rBPF, function "relocate" in the file src/elf.rs has an integer overflow bug because the sym.st_value is read directly from ELF file without checking. If the sym.st_value is rather large, an integer overflow is triggered while calculating the variable "addr" via addr = (sym.st_value + refd_pa) as u64

Database specific 
{
    "cwe_ids":  [
        "CWE-190"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2022-01-28T19:06:48Z",
    "nvd_published_at":  "2022-01-27T18:15:00Z",
    "severity":  "HIGH"
}
References

Affected packages

crates.io / solana_rbpf

Package

Name
solana_rbpf
View open source insights on deps.dev
Purl
pkg:cargo/solana_rbpf

Affected ranges

Type
SEMVER
Events
Introduced
0.2.14
Fixed
0.2.17

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-xwqr-xmgg-j69q/GHSA-xwqr-xmgg-j69q.json"