PT-2021-23133 · Evm · Evm

Rakita · Published 2021-10-18 · Updated 2021-10-22 · CVE-2021-41153

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions evm crate versions < 0.31.0

Description The evm crate, a pure Rust implementation of Ethereum Virtual Machine, has an issue where the JUMPI opcode's condition is checked after the destination validity check, contrary to the expected behavior as per Geth and OpenEthereum, where the condition check should happen before the destination validity check. This issue poses a high severity security risk if the evm crate is used for Ethereum mainnet, but a low severity risk if used in Frontier or a standalone blockchain, as there's no potential for security exploits in those cases.

Recommendations For evm crate versions < 0.31.0 used in Ethereum mainnet, update the library dependency immediately to version 0.31.0 or later. For evm crate versions < 0.31.0 used in Frontier or other pallet-evm based Substrate blockchain, ensure to update the spec version before updating to version 0.31.0 or later. For evm crate versions < 0.31.0 used in other blockchains, follow a hard-fork process before updating to version 0.31.0 or later. If dependent on an older version of evm and unable to update due to API interface changes, contact the maintainer for assistance with patch releases for older evm versions.

Fix

Weakness Enumeration

CWE-670

Related Identifiers

CVE-2021-41153

GHSA-PVH2-PJ76-4M96

Affected Products

Evm

References · 7

• https://github.com/rust-blockchain/evm/pull/67 · Patch
• https://github.com/rust-blockchain/evm/security/advisories/GHSA-pvh2-pj76-4m96 · Patch
• https://osv.dev/vulnerability/CVE-2021-41153 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pvh2-pj76-4m96 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41153 · Security Note
• https://github.com/rust-blockchain/evm · Note
• https://t.me/cibsecurity/30739 · Telegram Post