CVE-2022-21685 Integer underflow in Frontier

What is CVE-2022-21685?

CVE-2022-21685 is a medium-severity vulnerability in paritytech frontier, published on 14 Jan 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Frontier is Substrate's Ethereum compatibility layer. Prior to commit number `8a93fdc6c9f4eb1d2f2a11b7ff1d12d70bf5a664`, a bug in Frontier's MODEXP precompile implementation can cause an integer underflow in certain conditions. This will cause a node crash for debug builds. For release builds (and production WebAssembly binaries), the impact is limited as it can only cause a normal EVM out-of-gas. Users who do not use MODEXP precompile in their runtime are not impacted. A patch is available in pull request #549.

Weakness: CWE-191

Which versions are affected by CVE-2022-21685?

2 open source packages ship an affected version, including pallet-evm-precompile-modexp. It affects 1 product.

Products include Parity Frontier.

How do I fix CVE-2022-21685?

No fix has been published for CVE-2022-21685 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-21685 being exploited?

There is no known exploitation of CVE-2022-21685 in the wild and no public exploit code.

Other vulnerabilities in paritytech frontier

• CVE-2023-45130 Frontier opcode SUICIDE touches too many storage values on large contracts High 7.5
• CVE-2023-28431 Frontier's modexp precompile is slow for even modulus High 7.5
• CVE-2022-36008 Message length overflow in frontier High 7.1
• CVE-2022-39242 Incorrect Calculation in Frontier leads to inflated Ethereum chain gas prices Medium 5.3
• CVE-2022-31111 Discrepency in transfer value and actual value due to incorrect truncation in Frontier Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cjg2-2fjg-fph4.