CVE-2022-21685

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-21685
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-21685.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-21685
Aliases
Published
2022-01-14T17:05:11Z
Modified
2026-07-15T01:49:19.849706942Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Integer underflow in Frontier
Details

Frontier is Substrate's Ethereum compatibility layer. Prior to commit number 8a93fdc6c9f4eb1d2f2a11b7ff1d12d70bf5a664, a bug in Frontier's MODEXP precompile implementation can cause an integer underflow in certain conditions. This will cause a node crash for debug builds. For release builds (and production WebAssembly binaries), the impact is limited as it can only cause a normal EVM out-of-gas. Users who do not use MODEXP precompile in their runtime are not impacted. A patch is available in pull request #549.

Database specific 
{
    "cwe_ids": [
        "CWE-191"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21685.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "8a93fdc"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/polkadot-evm/frontier

Affected ranges

Type
GIT
Repo
https://github.com/polkadot-evm/frontier
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8a93fdc6c9f4eb1d2f2a11b7ff1d12d70bf5a664
Database specific 
{
    "source": "REFERENCES"
}

Affected versions

fc-consensus-v1.*
fc-consensus-v1.0.0
fc-consensus-v2.*
fc-consensus-v2.0.0
fc-db-v1.*
fc-db-v1.0.0
fc-mapping-sync-v1.*
fc-mapping-sync-v1.0.0
fc-rpc-core-v1.*
fc-rpc-core-v1.0.0
fc-rpc-v1.*
fc-rpc-v1.0.0
fp-consensus-v1.*
fp-consensus-v1.0.0
fp-evm-v1.*
fp-evm-v1.0.0
fp-evm-v2.*
fp-evm-v2.0.0
fp-rpc-v1.*
fp-rpc-v1.0.0
fp-rpc-v2.*
fp-rpc-v2.0.0
fp-rpc-v2.1.0
fp-storage-v1.*
fp-storage-v1.0.0
fp-storage-v1.0.1
fp-storage-v2.*
fp-storage-v2.0.0
pallet-dynamic-fee-v1.*
pallet-dynamic-fee-v1.0.0
pallet-dynamic-fee-v2.*
pallet-dynamic-fee-v2.0.0
pallet-dynamic-fee-v3.*
pallet-dynamic-fee-v3.0.0
pallet-ethereum-v1.*
pallet-ethereum-v1.0.0
pallet-ethereum-v2.*
pallet-ethereum-v2.0.0
pallet-ethereum-v3.*
pallet-ethereum-v3.0.0
pallet-evm-precompile-blake2-v1.*
pallet-evm-precompile-blake2-v1.0.0
pallet-evm-precompile-bn128-v1.*
pallet-evm-precompile-bn128-v1.0.0
pallet-evm-precompile-dispatch-v1.*
pallet-evm-precompile-dispatch-v1.0.0
pallet-evm-precompile-ed25519-v1.*
pallet-evm-precompile-ed25519-v1.0.0
pallet-evm-precompile-modexp-v1.*
pallet-evm-precompile-modexp-v1.0.0
pallet-evm-precompile-sha3fips-v1.*
pallet-evm-precompile-sha3fips-v1.0.0
pallet-evm-precompile-simple-v1.*
pallet-evm-precompile-simple-v1.0.0
pallet-evm-v3.*
pallet-evm-v3.0.0
pallet-evm-v4.*
pallet-evm-v4.0.0
pallet-evm-v5.*
pallet-evm-v5.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-21685.json"