// For flags

CVE-2022-36008

Message length overflow in frontier

Severity Score

6.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Frontier is Substrate's Ethereum compatibility layer. A security issue was discovered affecting parsing of the RPC result of the exit reason in case of EVM reversion. In release build, this would cause the exit reason being incorrectly parsed and returned by RPC. In debug build, this would cause an overflow panic. No action is needed unless you have a bridge node that needs to distinguish different reversion exit reasons and you used RPC for this. There are currently no known workarounds.

Frontier es la capa de compatibilidad con Ethereum de Substrate. Ha sido detectado un problema de seguridad que afecta al análisis del resultado RPC de la razón de salida en caso de reversión de EVM. En la versión de lanzamiento, esto causaba que la razón de salida fuera analizada y devuelta por RPC de forma incorrecta. En la compilación de depuración, esto causaría un pánico de desbordamiento. No es necesario realizar ninguna acción, a menos que tenga un nodo puente que necesite distinguir diferentes motivos de salida de la reversión y utilice RPC para ello. Actualmente no se presentan mitigaciones conocidas.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
Low
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-07-15 CVE Reserved
  • 2022-08-19 CVE Published
  • 2024-04-09 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-190: Integer Overflow or Wraparound
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Parity
Search vendor "Parity"
Frontier
Search vendor "Parity" for product "Frontier"
--
Affected