Elrond-GO up to 1.3.49 Node resource transfer

Summaryinfo

A vulnerability was found in Elrond-GO up to 1.3.49. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Node Handler. Executing a manipulation can lead to resource transfer. The identification of this vulnerability is CVE-2022-46173. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in Elrond-GO up to 1.3.49. This vulnerability affects some unknown processing of the component Node Handler. The manipulation with an unknown input leads to a resource transfer vulnerability. The CWE definition for the vulnerability is CWE-669. The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource. As an impact it is known to affect integrity, and availability. CVE summarizes:

Elrond-GO is a go implementation for the Elrond Network protocol. Versions prior to 1.3.50 are subject to a processing issue where nodes are affected when trying to process a cross-shard relayed transaction with a smart contract deploy transaction data. The problem was a bad correlation between the transaction caches and the processing component. If the above-mentioned transaction was sent with more gas than required, the smart contract result (SCR transaction) that should have returned the leftover gas, would have been wrongly added to a cache that the processing unit did not consider. The node stopped notarizing metachain blocks. The fix was actually to extend the SCR transaction search in all other caches if it wasn't found in the correct (expected) sharded-cache. There are no known workarounds at this time. This issue has been patched in version 1.3.50.

The weakness was shared 12/28/2022 as GHSA-p228-4mrh-ww7r. The advisory is shared for download at github.com. This vulnerability was named CVE-2022-46173 since 11/28/2022. There are neither technical details nor an exploit publicly available.

Upgrading to version 1.3.50 eliminates this vulnerability. Applying the patch 39d7ddcb08bb34217dab6daef7cd9d287fb8cab3 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Elrond-GO

Version

• 1.3.0
• 1.3.1
• 1.3.2
• 1.3.3
• 1.3.4
• 1.3.5
• 1.3.6
• 1.3.7
• 1.3.8
• 1.3.9
• 1.3.10
• 1.3.11
• 1.3.12
• 1.3.13
• 1.3.14
• 1.3.15
• 1.3.16
• 1.3.17
• 1.3.18
• 1.3.19
• 1.3.20
• 1.3.21
• 1.3.22
• 1.3.23
• 1.3.24
• 1.3.25
• 1.3.26
• 1.3.27
• 1.3.28
• 1.3.29
• 1.3.30
• 1.3.31
• 1.3.32
• 1.3.33
• 1.3.34
• 1.3.35
• 1.3.36
• 1.3.37
• 1.3.38
• 1.3.39
• 1.3.40
• 1.3.41
• 1.3.42
• 1.3.43
• 1.3.44
• 1.3.45
• 1.3.46
• 1.3.47
• 1.3.48
• 1.3.49

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion