PT-2022-24922 · Sputnikvm · Sputnikvm

Published 2022-10-25 · Updated 2022-10-28 · CVE-2022-39354

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions SputnikVM versions prior to 0.36.0

Description A custom stateful precompile can use the is static parameter to determine if the call is executed in a static context, and thus decide if stateful operations should be done. Prior to version 0.36.0, the passed is static parameter was incorrect -- it was only set to true if the call came from a direct STATICCALL opcode. However, once a static call context is entered, it should stay static. The issue only impacts custom precompiles that actually use is static. For those affected, the issue can lead to possible incorrect state transitions.

Recommendations For versions prior to 0.36.0, update to version 0.36.0 to resolve the issue. As a temporary workaround, consider reviewing custom precompiles that use the is static parameter to ensure they handle stateful operations correctly until the update is applied.

Exploit

Fix

Weakness Enumeration

CWE-670

Related Identifiers

CVE-2022-39354

GHSA-HHC4-47RH-CR34

RUSTSEC-2022-0083

Affected Products

Sputnikvm

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39354.json · Exploit
• https://github.com/rust-blockchain/evm/pull/133 · Patch
• https://osv.dev/vulnerability/CVE-2022-39354 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hhc4-47rh-cr34 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2022-0083 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39354 · Security Note
• https://github.com/rust-blockchain/evm/security/advisories/GHSA-hhc4-47rh-cr34 · Note
• https://github.com/rust-blockchain/evm · Note
• https://rustsec.org/advisories/RUSTSEC-2022-0083.html · Note
• https://t.me/cibsecurity/52065 · Telegram Post
• https://crates.io/crates/evm · Note