Researcher Demonstrates RCE in Solana Validator

Summary

Ginoah explains a patched Solana validator vulnerability introduced in version 1.16 and demonstrates how a malicious program could exploit memory mapping to achieve remote code execution.

Key points

• The vulnerability was introduced by the direct-mapping optimization in Solana 1.16 and had been patched by the time of the talk.
• During cross-program invocation, a memory-region update used a virtual address controlled by the calling program without ensuring it pointed to the correct account data.
• The researcher used writable accounts of different lengths to obtain out-of-bounds host-memory access, then described turning it into arbitrary reads and writes.
• The demonstration used a return-oriented programming chain to execute code on a default-configured validator and obtain a reverse shell.

People

Products

Related Articles

• MALFEX: Malicious npm Supply-Chain Campaign Went Unadvised for 14 Monthscloudsek.comSolana
• MovieReaper Malware Spreads Through Movie Torrents and Uses Solana for C2securelist.comSolana
• DNS Analysis Links SourTrade IoCs to Malicious Domains and IP Addressescircleid.comSolana
• Malware Uses Blockchain Dead Drops to Retrieve Runtime C2 Pointersnetskope.comSolana
• CloudSEK Finds AI-Agent-Driven Campaign Behind 12,000 WordPress Backdoors and Crypto Theftcloudsek.comSolana