rust-ethereum EVM up to 0.41.0 record_external_operation improper check or handling of exceptional conditions

Summaryinfo

A vulnerability, which was classified as problematic, was found in rust-ethereum EVM up to 0.41.0. This vulnerability affects the function record_external_operation. Executing a manipulation can lead to improper check or handling of exceptional conditions. This vulnerability appears as CVE-2024-21629. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in rust-ethereum EVM up to 0.41.0 and classified as problematic. This vulnerability affects the function record_external_operation. The manipulation with an unknown input leads to a improper check or handling of exceptional conditions vulnerability. The CWE definition for the vulnerability is CWE-703. The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product. As an impact it is known to affect integrity. CVE summarizes:

Rust EVM is an Ethereum Virtual Machine interpreter. In `rust-evm`, a feature called `record_external_operation` was introduced, allowing library users to record custom gas changes. This feature can have some bogus interactions with the call stack. In particular, during finalization of a `CREATE` or `CREATE2`, in the case that the substack execution happens successfully, `rust-evm` will first commit the substate, and then call `record_external_operation(Write(out_code.len()))`. If `record_external_operation` later fails, this error is returned to the parent call stack, instead of `Succeeded`. Yet, the substate commitment already happened. This causes smart contracts able to commit state changes, when the parent caller contract receives zero address (which usually indicates that the execution has failed). This issue only impacts library users with custom `record_external_operation` that returns errors. The issue is patched in release 0.41.1. No known workarounds are available.

The weakness was presented 01/03/2024 as GHSA-27wg-99g8-2v4v. The advisory is available at github.com. This vulnerability was named CVE-2024-21629 since 12/29/2023. Technical details are known, but there is no available exploit.

Upgrading to version 0.41.1 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch d8991ec727ad0fb64fe9957a3cd307387a6701e4 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• rust-ethereum

Name

• EVM

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29
• 0.30
• 0.31
• 0.32
• 0.33
• 0.34
• 0.35
• 0.36
• 0.37
• 0.38
• 0.39
• 0.40
• 0.41.0

License

• open-source

Website

• Product: https://github.com/rust-ethereum/evm/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion