PT-2021-16812 · Unknown · Cosmos Network Ethermint

Summerproo · Published 2021-02-08 · Updated 2021-02-12 · CVE-2021-25837

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Cosmos Network Ethermint versions <= 0.4.0

Description The issue is related to cache lifecycle inconsistency in the EVM module. This inconsistency occurs between the Storage caching cycle and the Tx processing cycle, causing Storage changes from failed transactions to be improperly reserved in memory. Although the bad storage cache data is discarded at EndBlock, it remains valid in the current block. This enables possible attacks, such as an "arbitrary mint token".

Recommendations For Cosmos Network Ethermint versions <= 0.4.0, update to a version greater than 0.4.0 to resolve the cache lifecycle inconsistency issue. As a temporary workaround, consider restricting the use of the EVM module until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2021-25837

Affected Products

Cosmos Network Ethermint

References · 5

• 🔥 https://github.com/cosmos/ethermint/issues/667#issuecomment-759284107 · Exploit
• 🔥 https://github.com/iczc/Ethermint-CVE-2021-25837 · Exploit
• https://osv.dev/vulnerability/CVE-2021-25837 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25837 · Security Note
• https://t.me/cibsecurity/23225 · Telegram Post