GHSA-hhc4-47rh-cr34

Source

https://github.com/advisories/GHSA-hhc4-47rh-cr34

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-hhc4-47rh-cr34/GHSA-hhc4-47rh-cr34.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-hhc4-47rh-cr34

Aliases

Published

2022-10-25T22:27:21Z

Modified

2023-11-08T04:10:19.736914Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

Incorrect is_static parameter for custom stateful precompiles in SputnikVM (evm)

Details

Impact

A custom stateful precompile can use the is_static parameter to determine if the call is executed in a static context (via STATICCALL), and thus decide if stateful operations should be done. Previously, the passed is_static parameter was incorrect -- it was only set to true if the call comes from a direct STATICCALL opcode. However, once a static call context is entered, it should stay static.

The issue only impacts custom precompiles that actually uses is_static. The maintainers estimate the usage is low. However, for those affected, it can lead to possible incorrect state transitions.

Patches

PR: https://github.com/rust-blockchain/evm/pull/133 Released in v0.36.0.

Older patch versions can be released on request if anyone needs them. Simply contact @sorpaas by email to request it.

For more information

If you have any questions or comments about this advisory: * Open an issue in evm repo * Email Wei at wei@that.world

Database specific

{
    "nvd_published_at": "2022-10-25T19:15:00Z",
    "github_reviewed_at": "2022-10-25T22:27:21Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-670"
    ]
}

References

Affected packages

crates.io / evm

Package

Name: evm; View open source insights on deps.dev
Purl: pkg:cargo/evm

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.36.0

Database specific

{
    "last_known_affected_version_range": "<= 0.35.0"
}