// For flags

CVE-2022-29219

Integer Overflow in Lodestar

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Lodestar is a TypeScript implementation of the Ethereum Consensus specification. Prior to version 0.36.0, there is a possible consensus split given maliciously-crafted `AttesterSlashing` or `ProposerSlashing` being included on-chain. Because the developers represent `uint64` values as native javascript `number`s, there is an issue when those variables with large (greater than 2^53) `uint64` values are included on chain. In those cases, Lodestar may view valid_`AttesterSlashing` or `ProposerSlashing` as invalid, due to rounding errors in large `number` values. This causes a consensus split, where Lodestar nodes are forked away from the main network. Similarly, Lodestar may consider invalid `ProposerSlashing` as valid, thus including in proposed blocks that will be considered invalid by the network. Version 0.36.0 contains a fix for this issue. As a workaround, use `BigInt` to represent `Slot` and `Epoch` values in `AttesterSlashing` and `ProposerSlashing` objects. `BigInt` is too slow to be used in all `Slot` and `Epoch` cases, so one may carefully use `BigInt` just where necessary for consensus.

Lodestar es una implementación de TypeScript de la especificación del Consenso de Ethereum. versiones anteriores a 0.36.0, se presenta una posible división del consenso debido a una inclusión en la cadena de "AttesterSlashing" o "ProposerSlashing" maliciosamente diseñados. Debido a que los desarrolladores representan valores "uint64" como "números" nativos de javascript, se presenta un problema cuando esas variables con valores "uint64" grandes (mayores de 2^53) son incluidas en la cadena. En esos casos, Lodestar puede visualizar valid_"AttesterSlashing" o "ProposerSlashing" como inválidos, debido a errores de redondeo en valores "numéricos" grandes. Esto causa una división del consenso, donde los nodos de Lodestar son bifurcados fuera de la red principal. Del mismo modo, Lodestar puede considerar inválidos los "ProposerSlashing" como válidos, incluyendo así en bloques propuestos que serán considerados no válidos por la red. La versión 0.36.0 contiene una corrección para este problema. Como mitigación, use "BigInt" para representar los valores "Slot" y "Epoch" en los objetos "AttesterSlashing" y "ProposerSlashing". "BigInt" es demasiado lento para ser usado en todos los casos de "Slot" y "Epoch", por lo que puede usarse cuidadosamente "BigInt" sólo cuando sea necesario para el consenso

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-04-13 CVE Reserved
  • 2022-05-24 CVE Published
  • 2023-12-15 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-190: Integer Overflow or Wraparound
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Chainsafe
Search vendor "Chainsafe"
Lodestar
Search vendor "Chainsafe" for product "Lodestar"
< 0.36.0
Search vendor "Chainsafe" for product "Lodestar" and version " < 0.36.0"
-
Affected