Add advisory for solana_rbpf: OOB pointer arithmetic in invoke_function

[DiuDiu777]

Affected crate(s)

• solana_rbpf (362,603 recent downloads per crates.io; 4,761,947 total downloads)

Links to upstream issue(s) or PR(s)

The upstream repository is archived, so I cannot report this through the normal upstream issue tracker.

• https://github.com/solana-labs/rbpf

Severity

Informational soundness issue. Safe Rust code can construct an EbpfVm and call the safe method EbpfVm::invoke_function, which performs out-of-bounds pointer arithmetic internally.

The affected implementation casts self to *mut u64 and applies a randomized offset from get_runtime_environment_key() using ptr::offset. This can move the pointer outside the allocation containing the EbpfVm, causing undefined behavior before the supplied builtin function is invoked. Miri reports an in-bounds pointer arithmetic violation. No unsafe code is required from the caller.

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate