CVE-2021-39137Medium· 6.5▾ SunlitEthereum Contains Consensus Flaw During Block Processing
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
1.5%
A vulnerability in the Geth EVM could cause a node to reject the canonical chain.
A memory-corruption bug within the EVM can cause a consensus error, where vulnerable nodes obtain a different stateRoot when processing a maliciously crafted transaction. This, in turn, would lead to the chain being split in two forks.
All Geth versions supporting the London hard fork are vulnerable (which predates London), so all users should update.
This bug was exploited on Mainnet at block 13107518, leading to a minority chain split.
A patch is included in the v1.10.8 release.
The exact patch to fix the issue is contained within this commit
No workarounds exist, save to update and/or apply the patch commit.
Post-mortem write-up.
The bug was found by @guidovranken (working for Sentnl during an audit of the Telos EVM) and reported via [email protected].
If you have any questions or comments about this advisory:
github.com/ethereum/go-ethereum >= 1.10.0, < 1.10.8Upgrade to a patched release:
github.com/ethereum/go-ethereum 1.10.8Connected by shared product, vendor, weakness, or advisory.
CVE-2020-26242Medium· 6.5Denial of service in geth
CVE-2020-26241Medium· 6.5Shallow copy bug in geth
CVE-2021-41173Medium· 5.7Geth Node Vulnerable to DoS via maliciously crafted p2p message
CVE-2022-23328High· 7.5A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account that all fully spend the full balance of the account to a victim Geth node, which can purge all o…
CVE-2022-23327High· 7.5A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a high gas price in one message, which can purge all of pending transactions in a victim node's memory pool, causing a …