CVE-2021-41153: Specification non-compliance in JUMPI

October 19, 2021 (updated October 25, 2021)

In evm crate < 0.31.0, JUMPI opcode’s condition is checked after the destination validity check. However, according to Geth and OpenEthereum, the condition check should happen before the destination validity check.

References

github.com/advisories/GHSA-pvh2-pj76-4m96
github.com/rust-blockchain/evm
github.com/rust-blockchain/evm/pull/67
github.com/rust-blockchain/evm/security/advisories/GHSA-pvh2-pj76-4m96
nvd.nist.gov/vuln/detail/CVE-2021-41153

Code Behaviors & Features

Detect and mitigate CVE-2021-41153 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →