PatchTheCVErbpf vulnerabilities and fixes
Recent CVEs affecting rbpf, with upgrade or downgrade steps. 3 tracked.
rbpf has 3 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 2. Most recent: 2022-05-21. Highest priority: CVE-2022-23066 (score 63/100).
- CVE-2022-31264 HIGH 7.5 UPGRADE Solana solana_rbpf before 0.2.29 has an addition integer overflow via invalid ELF program headers
- CVE-2022-23066 CRITICAL 9.1 DOWNGRADE In Solana rBPF versions 0.2.26 and 0.2.27 are affected by Incorrect Calculation which is caused by improper im
- CVE-2021-46102 HIGH 7.5 UPGRADE From version 0.2.14 to 0.2.16 for Solana rBPF, function "relocate" in the file src/elf.rs has an integer overf
FAQ
How do I fix rbpf vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is rbpf being exploited right now?
None of the tracked rbpf CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which rbpf CVE should I patch first?
CVE-2022-23066 currently ranks highest (63/100): In Solana rBPF versions 0.2.26 and 0.2.27 are affected by Incorrect Calculation which is caused by improper im.