CVE-2022-39354 evm has incorrect is_static parameter for custom stateful precompiles

What is CVE-2022-39354?

CVE-2022-39354 is a medium-severity vulnerability in rust-blockchain evm, published on 25 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SputnikVM, also called evm, is a Rust implementation of Ethereum Virtual Machine. A custom stateful precompile can use the `is_static` parameter to determine if the call is executed in a static context (via `STATICCALL`), and thus decide if stateful operations should be done. Prior to version 0.36.0, the passed `is_static` parameter was incorrect -- it was only set to `true` if the call came from a direct `STATICCALL` opcode. However, once a static call context is entered, it should stay static. The issue only impacts custom precompiles that actually uses `is_static`. For those affected, the issue can lead to possible incorrect state transitions. Version 0.36.0 contains a patch. There are no known workarounds.

Weakness: CWE-670

Which versions are affected by CVE-2022-39354?

3 open source packages ship an affected version, including evm. It affects 1 product.

Products include Evm Project Evm.

How do I fix CVE-2022-39354?

Upgrade evm to 0.36.0 or later.

Is CVE-2022-39354 being exploited?

There is no known exploitation of CVE-2022-39354 in the wild and no public exploit code.

Other vulnerabilities in rust-blockchain evm

• CVE-2021-41153 Specification non-compliance in JUMPI High 8.7
• CVE-2021-29511 Memory over-allocation in evm crate Medium 6.5
• CVE-2024-21629 Erroneous handling of `record_external_operation` error return Medium 5.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-hhc4-47rh-cr34, RUSTSEC-2022-0083.