GHSA-773q-5334-5gf9 Memory over-allocation in evm-core
An attacker can cause denial of service by triggering memory over-allocation in the evm-core library via specific EVM opcodes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-773q-5334-5gf9?
GHSA-773q-5334-5gf9 is a denial of service vulnerability in evm-core, published on 11 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Prior to the patch, when executing specific EVM opcodes related
to memory operations that use evm_core::Memory::copy_large, the
crate can over-allocate memory when it is not needed, making it
possible for an attacker to perform denial-of-service attack.
The flaw was corrected in commit 19ade85.
Which versions are affected by GHSA-773q-5334-5gf9?
11 open source packages ship an affected version, including evm-core.
| Package | Affected | Fixed in |
|---|---|---|
evm-core crates.io | All versions | 0.21.1 |
evm-core crates.io | All versions | 0.21.1 |
evm-core crates.io | From 0.0.0-0 | 0.21.1, 0.23.1, 0.24.1, 0.25.1, 0.26.1 |
evm-core crates.io | From 0.23.0 | 0.23.1 |
evm-core crates.io | From 0.23.0 | 0.23.1 |
evm-core crates.io | From 0.24.0 | 0.24.1 |
5 more packages
evm-core crates.io | From 0.24.0 | 0.24.1 |
evm-core crates.io | From 0.25.0 | 0.25.1 |
evm-core crates.io | From 0.25.0 | 0.25.1 |
evm-core crates.io | From 0.26.0 | 0.26.1 |
evm-core crates.io | From 0.26.0 | 0.26.1 |
How do I fix GHSA-773q-5334-5gf9?
Upgrade evm-core to a fixed version for your release line: 0.21.1, 0.23.1, 0.24.1 or 0.25.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-773q-5334-5gf9 being exploited?
There is no known exploitation of GHSA-773q-5334-5gf9 in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2021-0066.