PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Rust, realloc, and references

osec.io | research | #memory-safety | #rust | #audit | #solana | #sdk | #realloc
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

OtterSec traces a subtle Solana SDK bug in AccountInfo::realloc — unchecked pointer math behind unsafe — explaining BPF loader ABI internals and how the audit uncovered it.
Published
Collected

Related coverage

blog · osec.io
Solana formal verification: a case study
OtterSec presents a framework for formal verification of Solana Anchor programs — autogenerated proof harnesses checked by the Kani verifier — with a Squads multisig case study.
blog · bughunters.google.com
Scaling Memory Safety: AI-Assisted Rewrites of C/C++ Dependencies to Rust
This coverage gives security teams current context for monitoring, validation, and remediation.
blog · wiz.io
Cloud-native Security for your Windows environment: Announcing the Wiz Runtime Sensor for Windows
The Wiz Runtime Sensor for Windows reaches GA, bringing real-time detection to Windows VMs and Kubernetes nodes via a minimal kernel footprint and memory-safe Rust design that avoids crashes.
blog · netspi.com
Rust’s Role in Embedded Security
Rust improves memory safety in embedded systems, eliminating entire vulnerability classes, but logic, hardware, and cryptographic flaws still demand rigorous security testing.
research · osec.io
Hitchhiker’s guide to Aptos fungible assets
OtterSec deep dive into Aptos fungible assets: how the new model addresses legacy Coin flaws such as freeze/burn bypass, plus issues found and fixed in pre-release audits.
research · depthfirst.com
Behind the GitLab RCE: A depthfirst Journey into the Ruby Ecosystem
The investigation shows how memory-safety flaws in native Ruby gems can become remotely reachable through widely deployed applications such as GitLab. Teams should inventory native-extension dependencies and move self-managed GitLab and Oj installations to fixed releases.
Back