CVE-2022-31264

CVE-2022-31264 affects Solana’s Solana RBPF prior to 0.2.29, where an addition integer overflow can occur due to invalid ELF program headers and the elf.rs component may panic on a malformed eBPF program. Public records from Red Hat, GHSA, OSV and PT Security corroborate a vulnerability in Solana...

CVE-2021-46102

Summary (CVE-2021-46102, Solana rBPF): Vulnerable releases are Solana rBPF 0.2.14–0.2.16. The issue resides in the relocate function of src/elf.rs, where sym.st_value is read directly from the ELF file without validation, enabling an integer overflow when computing the address (addr = (sym.st_val...