CVE-2022-31264: Integer overflow in solana_rbpf

May 22, 2022 (updated June 3, 2022)

Solana solana_rbpf before 0.2.29 has an addition integer overflow via invalid ELF program headers. elf.rs has a panic via a malformed eBPF program.

References

github.com/Ainevsia/CVE-Request/tree/main/Solana/1
github.com/advisories/GHSA-ffx3-8qvm-pq3j
github.com/solana-labs/rbpf
github.com/solana-labs/rbpf/releases/tag/v0.2.29
nvd.nist.gov/vuln/detail/CVE-2022-31264

Detect and mitigate CVE-2022-31264 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →