CVE-2022-35936
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-35936
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-35936.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-35936
- Aliases
- Related
- Published
- 2022-08-05T13:15:08Z
- Modified
- 2025-02-19T03:28:40.132307Z
- Severity
-
- 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
- Summary
- [none]
- Details
-
Ethermint is an Ethereum library. In Ethermint running versions before
v0.17.2, the contractselfdestructinvocation permanently removes the corresponding bytecode from the internal database storage. However, due to a bug in theDeleteAccountfunction, all contracts that used the identical bytecode (i.e shared the sameCodeHash) will also stop working once one contract invokesselfdestruct, even though the other contracts did not invoke theselfdestructOPCODE. This vulnerability has been patched in Ethermint version v0.18.0. The patch has state machine-breaking changes for applications using Ethermint, so a coordinated upgrade procedure is required. A workaround is available. If a contract is subject to DoS due to this issue, the user can redeploy the same contract, i.e. with identical bytecode, so that the original contract's code is recovered. The new contract deployment restores thebytecode hash -> bytecodeentry in the internal state. - References
Affected packages
Git / github.com/evmos/ethermint
Affected ranges
- Type
- GIT
- Repo
- https://github.com/evmos/ethermint
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
- Type
- GIT
- Repo
- https://github.com/evmos/evmos
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Type
- GIT
- Repo
- https://github.com/kava-labs/kava
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed