PT-2023-29428 · Frontier · Frontier

Publicado 2023-10-13 · Atualizado 2023-10-24 · CVE-2023-45130

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Frontier versions prior to commit aea528198b3b226e0d20cce878551fd4c0e3d5d0

Description The issue arises when opcode SUICIDE marks a contract to be deleted, and the software uses storage::remove prefix (now renamed to storage::clear prefix) to remove all storages associated with it. This can be slow for large contracts and may exceed the relay chain's Proof of Validity (PoV) size limit for parachains. An attacker can craft a contract with numerous storage values on a parachain, call opcode SUICIDE, and potentially stall the parachain if the transaction is included in a block. This is particularly problematic for XCM transactions, which cannot be skipped.

Recommendations For parachains, issue an emergency runtime upgrade as soon as possible. For standalone chains, issue a normal runtime upgrade as soon as possible.

Exploit

Correção

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

CVE-2023-45130

GHSA-GC88-2GVV-GP3V

Produtos afetados

Frontier

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45130.json · Exploit
• https://github.com/paritytech/frontier/commit/aea528198b3b226e0d20cce878551fd4c0e3d5d0 · Correção
• https://github.com/paritytech/frontier/pull/1212 · Aviso do Fabricante
• https://github.com/paritytech/frontier/security/advisories/GHSA-gc88-2gvv-gp3v · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-45130 · Aviso do Fabricante
• https://t.me/cibsecurity/72236 · Publicação no Telegram
• https://t.me/cvenotify/59432 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-45130 · Nota de Segurança