CVE-2022-37450: Go Ethereum allows attackers to use manipulation of time-difference values to achieve replacement of main-chain blocks
(updated )
Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making (RUM), as exploited in the wild in 2020 through 2022.
References
- dx.doi.org/10.13140/RG.2.2.27813.99043
- github.com/advisories/GHSA-rqmg-hrg4-fm69
- github.com/ethereum/go-ethereum/blob/671094279e8d27f4b4c3c94bf8b636c26b473976/core/forkchoice.go
- medium.com/@aviv.yaish/uncle-maker-time-stamping-out-the-competition-in-ethereum-d27c1cb62fef
- news.ycombinator.com/item?id=32354896
- nvd.nist.gov/vuln/detail/CVE-2022-37450
Code Behaviors & Features
Detect and mitigate CVE-2022-37450 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →