PT-2022-27787 · Elrond-Go · Elrond-Go

Iulianpascalau · Published 2022-12-28 · Updated 2024-08-21 · CVE-2022-46173

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Elrond-GO versions prior to 1.3.50

Description The issue is a processing problem where nodes are affected when trying to process a cross-shard relayed transaction with a smart contract deploy transaction data. This occurs due to a bad correlation between the transaction caches and the processing component. If a transaction is sent with more gas than required, the smart contract result (SCR transaction) that should return the leftover gas is wrongly added to a cache that the processing unit does not consider, causing the node to stop notarizing metachain blocks. The fix involves extending the SCR transaction search in all other caches if it isn't found in the correct sharded-cache.

Recommendations For versions prior to 1.3.50, update to version 1.3.50 or later to resolve the issue. As a temporary workaround, consider extending the SCR transaction search in all other caches if it wasn't found in the correct sharded-cache, until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-669

Related Identifiers

CVE-2022-46173

GHSA-P228-4MRH-WW7R

GO-2022-1200

Affected Products

Elrond-Go

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/46xxx/CVE-2022-46173.json · Exploit
• https://github.com/ElrondNetwork/elrond-go/commit/39d7ddcb08bb34217dab6daef7cd9d287fb8cab3 · Patch
• https://github.com/ElrondNetwork/elrond-go/pull/4718 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-46173 · Security Note
• https://osv.dev/vulnerability/GO-2022-1200 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-46173 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p228-4mrh-ww7r · Vendor Advisory
• https://github.com/ElrondNetwork/elrond-go/security/advisories/GHSA-p228-4mrh-ww7r · Note
• https://github.com/ElrondNetwork/elrond-go · Note
• https://t.me/cvenotify/41562 · Telegram Post
• https://t.me/cibsecurity/55466 · Telegram Post