CVE-2021-46102: Integer Overflow
From version 0.2.14 to 0.2.16 for Solana rBPF, function "relocate" in the file src/elf.rs has an integer overflow bug because the sym.stvalue is read directly from ELF file without checking. If the sym.stvalue is rather large, an integer overflow is triggered while calculating the variable "addr" via "addr = (sym.stvalue + refdpa) as u64";
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-46102?
The severity of CVE-2021-46102 is classified as high with a CVSS score of 7.5.
How do I fix CVE-2021-46102?
To fix CVE-2021-46102, you should apply the available patch provided by Solanalabs for the rBPF library.
What is the impact of CVE-2021-46102?
CVE-2021-46102 can lead to an integer overflow which may result in denial of service conditions in affected versions.
Which versions of Solanalabs rBPF are affected by CVE-2021-46102?
CVE-2021-46102 affects Solanalabs rBPF versions from 0.2.14 to 0.2.16.
What type of vulnerability is CVE-2021-46102?
CVE-2021-46102 is categorized as an integer overflow vulnerability.