CVE-2022-21685: Integer underflow in Frontier

January 14, 2022

A bug in Frontier’s MODEXP precompile implementation can cause an integer underflow in certain conditions. This will cause a node crash for debug builds. For release builds (and production WebAssembly binaries), the impact is limited as it can only cause a normal EVM out-of-gas. It is recommended that you apply the patch as soon as possible.

If you do not use MODEXP precompile in your runtime, then you are not impacted.

References

github.com/advisories/GHSA-cjg2-2fjg-fph4
github.com/paritytech/frontier
github.com/paritytech/frontier/commit/8a93fdc6c9f4eb1d2f2a11b7ff1d12d70bf5a664
github.com/paritytech/frontier/pull/549
github.com/paritytech/frontier/security/advisories/GHSA-cjg2-2fjg-fph4
nvd.nist.gov/vuln/detail/CVE-2022-21685

Code Behaviors & Features

Detect and mitigate CVE-2022-21685 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →