CVE-2022-35915 Unbounded gas consumption in @openzeppelin/contracts
Attackers can cause unbounded gas consumption in smart contracts using OpenZeppelin's EIP-165 interface checks, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-35915?
CVE-2022-35915 is a medium-severity denial of service vulnerability in openzeppelin-contracts, published on 1 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenZeppelin Contracts is a library for secure smart contract development. The target contract of an EIP-165 `supportsInterface` query can cause unbounded gas consumption by returning a lot of data, while it is generally assumed that this operation has a bounded cost. The issue has been fixed in v4.7.2. Users are advised to upgrade. There are no known workarounds for this issue.
Which versions are affected by CVE-2022-35915?
8 open source packages ship an affected version, including @openzeppelin/contracts, @openzeppelin/contracts-upgradeable and openzeppelin-eth. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
@openzeppelin/contracts npm | From 2.0.0 | 4.7.2 |
@openzeppelin/contracts npm | From 2.0.0 | 4.7.2 |
@openzeppelin/contracts-upgradeable npm | From 3.2.0 | 4.7.2 |
@openzeppelin/contracts-upgradeable npm | From 3.2.0 | 4.7.2 |
openzeppelin-eth npm | From 2.0.0 to 2.2.0 | None |
openzeppelin-eth npm | From 2.0.0 to 2.2.0 | None |
2 more packages
openzeppelin-solidity npm | From 2.0.0 to 4.6.0 | None |
openzeppelin-solidity npm | From 2.0.0 to 4.6.0 | None |
Products include Openzeppelin Contracts, Openzeppelin Contracts Upgradeable, Openzeppelin Openzeppelin-Eth, Openzeppelin Openzeppelin-Solidity.
How do I fix CVE-2022-35915?
Upgrade @openzeppelin/contracts to 4.7.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-35915 being exploited?
There is no known exploitation of CVE-2022-35915 in the wild and no public exploit code.
Other vulnerabilities in openzeppelin-contracts
- CVE-2021-39167 TimelockController vulnerability in OpenZeppelin Contracts
- CVE-2021-39168 TimelockController vulnerability in OpenZeppelin Contracts
- CVE-2021-41264 UUPSUpgradeable vulnerability in OpenZeppelin Contracts
- CVE-2022-35961 ECDSA signature malleability in OpenZeppelin Contracts
- CVE-2022-31198 GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts
Sources
Also known as GHSA-7grf-83vw-6f5x.