PT-2022-20536 · Frontier · Frontier

Wei Tang · Published 2022-07-06 · Updated 2022-07-14 · CVE-2022-31111

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Frontier (affected versions not specified)

Description The issue is related to the truncation done when converting between EVM balance type and Substrate balance type in Frontier, Substrate's Ethereum compatibility layer. This incorrect implementation leads to a possible discrepancy between the appeared EVM transfer value and the actual Substrate value transferred. The vulnerability affects only EVM internal states, but not Substrate balance states or node.

Recommendations To resolve the issue, it is recommended to plan an emergency upgrade. As a temporary workaround, consider setting up a Substrate CallFilter that disables pallet-evm and pallet-ethereum calls before the patch can be applied. For versions prior to the fixed version in the Frontier master branch commit fed5e0a9577c10bea021721e8c2c5c378e16bf66 and polkadot-v0.9.22 branch commit e3e427fa2e5d1200a784679f8015d4774cedc934, apply the patch to fix the issue.

Exploit

Fix

Weakness Enumeration

CWE-670

Related Identifiers

CVE-2022-31111

GHSA-HC8W-MX86-9FCJ

Affected Products

Frontier

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31111.json · Exploit
• https://github.com/paritytech/frontier/commit/fed5e0a9577c10bea021721e8c2c5c378e16bf66 · Patch
• https://github.com/paritytech/frontier/security/advisories/GHSA-hc8w-mx86-9fcj · Patch
• https://github.com/paritytech/frontier/pull/753 · Patch
• https://github.com/paritytech/frontier/commit/e3e427fa2e5d1200a784679f8015d4774cedc934 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-31111 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31111 · Vendor Advisory
• https://t.me/cvenotify/32692 · Telegram Post
• https://t.me/cibsecurity/45695 · Telegram Post