-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| solana_rbpf | rust | < 0.2.29 | 0.2.29 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper validation of ELF program headers in solana_rbpf's ELF parsing logic. The POC demonstrates that crafted ELF headers with large p_vaddr and p_memsz values trigger an overflow in goblin's vm_range method. While the panic occurs in goblin's code, the root cause is solana_rbpf's failure to validate these fields before passing control to the library. The Executable::load function in src/elf.rs is directly responsible for loading and processing the ELF, making it the entry point for this vulnerability. The fix in v0.2.29 likely added validation checks in this function or its dependencies to prevent the overflow.