CVE-2021-41272 – SHL, SHR, and SAR operations trigger native exception at key values in besu

https://notcve.org/view.php?id=CVE-2021-41272

Besu is an Ethereum client written in Java. Starting in version 21.10.0, changes in the implementation of the SHL, SHR, and SAR operations resulted in the introduction of a signed type coercion error in values that represent negative values for 32 bit signed integers. Smart contracts that ask for shifts between approximately 2 billion and 4 billion bits (nonsensical but valid values for the operation) will fail to execute and hence fail to validate. In networks where vulnerable versions are mining with other clients or non-vulnerable versions this will result in a fork and the relevant transactions will not be included in the fork. In networks where vulnerable versions are not mining (such as Rinkeby) no fork will result and the validator nodes will stop accepting blocks. • https://github.com/hyperledger/besu/commit/4170524ac3b45185704fcfbdeeb71b0b05dfa0a1 https://github.com/hyperledger/besu/pull/3039 https://github.com/hyperledger/besu/security/advisories/GHSA-7pg2-p5vj-xp5h • CWE-681: Incorrect Conversion between Numeric Types •