PT-2022-19471 · Lodestar · Lodestar

Philknows · Published 2022-05-24 · Updated 2022-06-07 · CVE-2022-29219

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Lodestar versions prior to 0.36.0

Description The issue is related to the representation of uint64 values as native JavaScript numbers in Lodestar, a TypeScript implementation of the Ethereum Consensus specification. When uint64 values greater than 2^53 are included on-chain, Lodestar may view valid AttesterSlashing or ProposerSlashing as invalid due to rounding errors in large number values, causing a consensus split. Similarly, Lodestar may consider invalid ProposerSlashing as valid, including them in proposed blocks that will be considered invalid by the network.

Recommendations As a temporary workaround, consider using BigInt to represent Slot and Epoch values in AttesterSlashing and ProposerSlashing objects, carefully using BigInt just where necessary for consensus. For versions prior to 0.36.0, update to version 0.36.0 to resolve the issue.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2022-29219

GHSA-CVJ7-5F3C-9VG9

Affected Products

Lodestar

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29219.json · Exploit
• https://github.com/ChainSafe/lodestar/security/advisories/GHSA-cvj7-5f3c-9vg9 · Patch
• https://github.com/ChainSafe/lodestar/pull/3977 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-29219 · Security Note
• https://osv.dev/vulnerability/GHSA-cvj7-5f3c-9vg9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-29219 · Vendor Advisory
• https://github.com/ChainSafe/lodestar · Note
• https://github.com/ChainSafe/lodestar/releases/tag/v0.36.0 · Note
• https://t.me/cibsecurity/43266 · Telegram Post