CVE-2022-21685: falha de média gravidade em paritytech frontier
Integer underflow in Frontier
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.5epss 1.4%
Frontier is Substrate's Ethereum compatibility layer. Prior to commit number `8a93fdc6c9f4eb1d2f2a11b7ff1d12d70bf5a664`, a bug in Frontier's MODEXP precompile implementation can cause an integer underflow in certain conditions. This will cause a node crash for debug builds. For release builds (and production WebAssembly binaries), the impact is limited as it can only cause a normal EVM out-of-gas. Users who do not use MODEXP precompile in their runtime are not impacted. A patch is available in pull request #549.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
paritytech · frontierCVEs relacionadas — paritytech frontier
No mesmo produto, das mais perigosas para as menos.
CVE-2022-31111MEDIUMDiscrepency in transfer value and actual value due to incorrect truncation in FrontierEPSS 1.4%CVE-2021-41138MEDIUMValidity check for signed Frontier-specific extrinsic not called in block executionEPSS 1.4%CVE-2022-36008HIGHMessage length overflow in frontierEPSS 1.3%CVE-2021-39193MEDIUMTransaction validity oversight in pallet-ethereumEPSS 1.2%CVE-2023-45130HIGHFrontier opcode SUICIDE touches too many storage values on large contractsEPSS 1.0%CVE-2023-28431HIGHFrontier's modexp precompile is slow for even modulusEPSS 0.9%