CVE-2022-23066: Solana rBPF - Incorrect Calculation in sdiv instruction

Published May 9, 2022

Updated

In Solana rBPF versions 0.2.26 and 0.2.27 are affected by Incorrect Calculation which is caused by improper implementation of sdiv instruction. This can lead to the wrong execution path, resulting in huge loss in specific cases. For example, the result of a sdiv instruction may decide whether to transfer tokens or not. The vulnerability affects both integrity and may cause serious availability problems.

Affected Software

2 affected components

Solana rBPF=0.2.26

Solana rBPF=0.2.27

Remediation

Patch Available

https://github.com/solana-labs/rbpf/commit/e61e045f8c244de978401d186dcfd50838817297

Information

Upgrade version to 0.2.28 or higher

Event History

May 9, 2022

CVE Published

via MITRE·06:25 AM

Data Sourced

via MITRE·06:25 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2022-23066?

CVE-2022-23066 is considered a critical vulnerability due to its potential to cause significant financial loss in specific execution scenarios.

How do I fix CVE-2022-23066?

To fix CVE-2022-23066, upgrade Solana rBPF to a version beyond 0.2.27 where the vulnerability has been addressed.

Which versions of Solana rBPF are affected by CVE-2022-23066?

Solana rBPF versions 0.2.26 and 0.2.27 are affected by CVE-2022-23066.

What could happen if CVE-2022-23066 is exploited?

Exploitation of CVE-2022-23066 can lead to incorrect execution paths, resulting in potential financial losses.

Is there a workaround for CVE-2022-23066?

There are no known workarounds for CVE-2022-23066, so patching is the recommended solution.