PT-2022-23107 · Frontier · Frontier

Wei Tang · Published 2022-08-18 · Updated 2022-08-25 · CVE-2022-36008

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions Frontier (affected versions not specified)

Description A security issue was discovered affecting the parsing of the RPC result of the exit reason in case of EVM reversion. This issue causes the exit reason to be incorrectly parsed and returned by RPC in release builds, and it causes an overflow panic in debug builds. The issue is relevant only if you have a bridge node that needs to distinguish different reversion exit reasons and you used RPC for this purpose.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2022-36008

GHSA-MJVM-MHGC-Q4GP

Affected Products

Frontier

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36008.json · Exploit
• https://github.com/paritytech/frontier/pull/820 · Patch
• https://github.com/paritytech/frontier/commit/fff8cc43b7756ce3979a38fc473f38e6e24ac451 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-36008 · Security Note
• https://osv.dev/vulnerability/GHSA-mjvm-mhgc-q4gp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-36008 · Vendor Advisory
• https://github.com/paritytech/frontier/security/advisories/GHSA-mjvm-mhgc-q4gp · Note
• https://github.com/paritytech/frontier · Note
• https://t.me/cvenotify/35000 · Telegram Post
• https://t.me/cvenotify/35154 · Telegram Post
• https://t.me/cibsecurity/48464 · Telegram Post