CVE-2022-21685 – pallet-evm-precompile-modexp

Package

Manager: cargo
Name: pallet-evm-precompile-modexp
Vulnerable Version: >=0 <=1.0.0

Severity

Level: Medium

CVSS v3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H/E:F/RL:O/RC:C

CVSS v4.0: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

EPSS: 0.00442 pctl0.6237

Details

Integer underflow in Frontier ### Impact A bug in Frontier's MODEXP precompile implementation can cause an integer underflow in certain conditions. This will cause a node crash for debug builds. For release builds (and production WebAssembly binaries), the impact is limited as it can only cause a normal EVM out-of-gas. It is recommended that you apply the patch as soon as possible. If you do not use MODEXP precompile in your runtime, then you are not impacted. ### Patches Patches are applied in PR #549. ### Workarounds None. ### References Patch PR: #549 ### Credits Thanks to SR-Labs for discovering the security vulnerability, and thanks to PureStake team for the patches. ### For more information If you have any questions or comments about this advisory: * Open an issue in the [Frontier repo](https://github.com/paritytech/frontier)

Metadata

Created: 2022-01-14T21:03:36Z
Modified: 2024-10-24T21:50:43Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-cjg2-2fjg-fph4/GHSA-cjg2-2fjg-fph4.json
CWE IDs: ["CWE-191"]
Alternative ID: GHSA-cjg2-2fjg-fph4
Finding: F111
Auto approve: 1