CVE-2022-36008 Message length overflow in frontier

What is CVE-2022-36008?

CVE-2022-36008 is a high-severity vulnerability in paritytech frontier, published on 19 Aug 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Frontier is Substrate's Ethereum compatibility layer. A security issue was discovered affecting parsing of the RPC result of the exit reason in case of EVM reversion. In release build, this would cause the exit reason being incorrectly parsed and returned by RPC. In debug build, this would cause an overflow panic. No action is needed unless you have a bridge node that needs to distinguish different reversion exit reasons and you used RPC for this. There are currently no known workarounds.

Weakness: CWE-190

Which versions are affected by CVE-2022-36008?

2 open source packages ship an affected version, including fc-rpc. It affects 1 product.

Products include Parity Frontier.

How do I fix CVE-2022-36008?

No fix has been published for CVE-2022-36008 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-36008 being exploited?

There is no known exploitation of CVE-2022-36008 in the wild and no public exploit code.

Other vulnerabilities in paritytech frontier

• CVE-2023-45130 Frontier opcode SUICIDE touches too many storage values on large contracts High 7.5
• CVE-2023-28431 Frontier's modexp precompile is slow for even modulus High 7.5
• CVE-2022-21685 Integer underflow in Frontier Medium 6.5
• CVE-2022-39242 Incorrect Calculation in Frontier leads to inflated Ethereum chain gas prices Medium 5.3
• CVE-2022-31111 Discrepency in transfer value and actual value due to incorrect truncation in Frontier Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mjvm-mhgc-q4gp.