PT-2022-23124 · Besu · Besu
Martin Holst Swende
·
Published
2022-09-23
·
Updated
2022-09-28
·
CVE-2022-36025
CVSS v3.1
9.1
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Besu versions 22.1.4 through 22.7.0
Description
The issue is related to an incorrect conversion between numeric types in the calculation of available gas in CALL operations, including DELEGATECALL. This results in incorrect gas being passed into called contracts and incorrect gas being returned after call execution. Where the amount of gas makes a difference in the success or failure, or if the gas is a negative 64-bit value, the execution will result in a different state root than expected, resulting in a consensus failure in networks with multiple EVM implementations. In networks with a single EVM implementation, this can be used to execute with significantly more gas than the transaction requested, possibly exceeding gas limitations.
Recommendations
For versions 22.1.4 through 22.7.0, update to version 22.7.1 to fix the issue.
As a temporary workaround for versions 22.1.4 through 22.7.0, reverting to version 22.1.3 or earlier will prevent incorrect execution. However, many Ethereum mainnet networks require changes in more recent versions of Besu and should not use older versions of Besu, and should instead use the patched version.
Ethereum Classic and other networks not depending on a Proof of Stake transition should function fine with version 22.1.3 or earlier.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Besu