Add advisory for solana_rbpf: OOB pointer arithmetic in invoke_function

[DiuDiu777]

Affected crate(s)

• solana_rbpf (362,603 recent downloads per crates.io; 4,761,947 total downloads)

Links to upstream issue(s) or PR(s)

The upstream repository is archived, so I cannot report this through the normal upstream issue tracker.

• https://github.com/solana-labs/rbpf

Severity

Informational soundness issue. Safe Rust code can construct an EbpfVm and call the safe method EbpfVm::invoke_function, which performs out-of-bounds pointer arithmetic internally.

The affected implementation casts self to *mut u64 and applies a randomized offset from get_runtime_environment_key() using ptr::offset. This can move the pointer outside the allocation containing the EbpfVm, causing undefined behavior before the supplied builtin function is invoked. Miri reports an in-bounds pointer arithmetic violation. No unsafe code is required from the caller.

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate

[djc]

@Lichtso do you think it makes sense to publish this, with a note attached to clarify that this crate is unmaintained?

[DiuDiu777]

Hi, gentle ping on this advisory PR. Is there anything I can provide or update to help move the review forward? Thanks!

[djc]

I reached out to someone privately, let's see if that helps.

[nagisa]

It should be fine to land this. The issue is fixed in solana-sbpf (anza-xyz/sbpf#151) which is the maintained incarnation of the crate this report is against. Maybe if there's a way to nudge people towards a different crate, we should do that. Otherwise LGTM!

[djc]

It should be fine to land this. The issue is fixed in solana-sbpf (anza-xyz/sbpf#151) which is the maintained incarnation of the crate this report is against. Maybe if there's a way to nudge people towards a different crate, we should do that. Otherwise LGTM!

Thanks!

[DiuDiu777]

Done~ :)