CVE-2021-46102
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
From version 0.2.14 to 0.2.16 for Solana rBPF, function "relocate" in the file src/elf.rs has an integer overflow bug because the sym.st_value is read directly from ELF file without checking. If the sym.st_value is rather large, an integer overflow is triggered while calculating the variable "addr" via "addr = (sym.st_value + refd_pa) as u64";
De la versión 0.2.14 a 0.2.16 para Solana rBPF, la función "relocate" en el archivo src/elf.rs presenta un bug de desbordamiento de enteros porque el sym.st_value es leído directamente del archivo ELF sin comprobarlo. Si el sym.st_value es bastante grande, es producido un desbordamiento de enteros mientras es calculada la variable "addr" por medio de "addr = (sym.st_value + refd_pa) as u64"
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-01-03 CVE Reserved
- 2022-01-27 CVE Published
- 2024-08-04 CVE Updated
- 2024-08-04 First Exploit
- 2024-10-12 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-190: Integer Overflow or Wraparound
CAPEC
References (4)
URL | Tag | Source |
---|
URL | Date | SRC |
---|---|---|
https://github.com/solana-labs/rbpf/pull/200 | 2023-04-26 | |
https://github.com/solana-labs/rbpf/pull/236 | 2023-04-26 |
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Solanalabs Search vendor "Solanalabs" | Rbpf Search vendor "Solanalabs" for product "Rbpf" | >= 0.2.14 <= 0.2.16 Search vendor "Solanalabs" for product "Rbpf" and version " >= 0.2.14 <= 0.2.16" | - |
Affected
|