CVE-2021-43839 Drainage of FeeCollector's Block Transaction Fees

High 7.5 Published 21 Dec 2021 Updated 4 Aug 2024

Attackers can drain block transaction fees from the FeeCollector by sending crafted Ethereum transactions, affecting Cronos blockchain validator nodes.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-43839?

CVE-2021-43839 is a high-severity vulnerability in crypto-org-chain cronos, published on 21 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Cronos is a commercial implementation of a blockchain. In Cronos nodes running versions before v0.6.5, it is possible to take transaction fees from Cosmos SDK's FeeCollector for the current block by sending a custom crafted MsgEthereumTx. This problem has been patched in Cronos v0.6.5. There are no tested workarounds. All validator node operators are recommended to upgrade to Cronos v0.6.5 at their earliest possible convenience.

Weakness: CWE-670

Which versions are affected by CVE-2021-43839?

8 open source packages ship an affected version, including github.com/crypto-org-chain/cronos, github.com/tharsis/ethermint and github.com/tharsis/evmos. It affects 3 products.

Package	Affected	Fixed in
`github.com/crypto-org-chain/cronos` Go	All versions	`0.6.5`
`github.com/crypto-org-chain/cronos` Go	All versions	`0.6.5`
`github.com/tharsis/ethermint` Go	All versions	`0.7.3`
`github.com/tharsis/ethermint` Go	All versions	`0.7.3`
`github.com/tharsis/ethermint` Go	From `0.8.0`	`0.10.0`
`github.com/tharsis/ethermint` Go	From `0.8.0`	`0.10.0`

2 more packages

`github.com/tharsis/evmos` Go	All versions to `0.4.2`	None
`github.com/tharsis/evmos` Go	All versions to `0.4.2`	None

Products include Crypto Cronos, Crypto Ethermint, Crypto Evmos.

How do I fix CVE-2021-43839?

Upgrade github.com/crypto-org-chain/cronos to 0.6.5 or later.

Is CVE-2021-43839 being exploited?

There is no known exploitation of CVE-2021-43839 in the wild and no public exploit code.

CVE-2022-35936 Ethermint DoS through Unintended Contract Selfdestruct High 8.2

Sources

Also known as GHSA-f854-hpxv-cw9r.