Medium severity · published Sep 3, 2021
CVE-2021-39193
Frontier is Substrate's Ethereum compatibility layer
5.3
CVSS
1.2%
EPSS
No
On KEV
Description
Frontier is Substrate's Ethereum compatibility layer. Prior to commit number 0b962f218f0cdd796dadfe26c3f09e68f7861b26, a bug in `pallet-ethereum` can cause invalid transactions to be included in the Ethereum block state in `pallet-ethereum` due to not validating the input data size. Any invalid transactions included this way have no possibility to alter the internal Ethereum or Substrate state. The transaction will appear to have be included, but is of no effect as it is rejected by the EVM engine. The impact is further limited by Substrate extrinsic size constraints. A patch is available in commit number 0b962f218f0cdd796dadfe26c3f09e68f7861b26. There are no workarounds aside from applying the patch.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
Frontier · Parity
before 2021-09-03 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-39193
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-39193
Patch
https://github.com/paritytech/frontier/commit/0b962f218f0cdd796dadfe26c3f09e68f7861b26
Patch
https://github.com/paritytech/frontier/pull/465
Patch
https://github.com/paritytech/frontier/pull/465/commits/8a2b890a2fb477d5fedd0e4335b00623832849ae
Patch
https://github.com/paritytech/frontier/security/advisories/GHSA-hw4v-5x4h-c3xm
More from Frontier
7.5
CVE-2023-45130
Frontier is Substrate's Ethereum compatibility layer
7.5
CVE-2023-28431
Frontier is an Ethereum compatibility layer for Substrate
6.5
CVE-2022-36008
Frontier is Substrate's Ethereum compatibility layer
6.5
CVE-2022-21685
Frontier is Substrate's Ethereum compatibility layer
5.3
CVE-2022-39242
Frontier is an Ethereum compatibility layer for Substrate
