Medium severity · published Oct 13, 2021
CVE-2021-41138
Frontier is Substrate's Ethereum compatibility layer
5.3
CVSS
1.4%
EPSS
No
On KEV
Description
Frontier is Substrate's Ethereum compatibility layer. In the newly introduced signed Frontier-specific extrinsic for `pallet-ethereum`, a large part of transaction validation logic was only called in transaction pool validation, but not in block execution. Malicious validators can take advantage of this to put invalid transactions into a block. The attack is limited in that the signature is always validated, and the majority of the validation is done again in the subsequent `pallet-evm` execution logic. However, do note that a chain ID replay attack was possible. In addition, spamming attacks are of main concerns, while they are limited by Substrate block size limits and other factors. The issue is patched in commit `146bb48849e5393004be5c88beefe76fdf009aba`.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
Frontier · Parity
2021-09-30 before 2021-10-13 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-41138
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-41138
Patch
https://github.com/paritytech/frontier/commit/146bb48849e5393004be5c88beefe76fdf009aba
Patch
https://github.com/paritytech/frontier/pull/497
Patch
https://github.com/paritytech/frontier/security/advisories/GHSA-vj62-g63v-f8mf
More from Frontier
7.5
CVE-2023-45130
Frontier is Substrate's Ethereum compatibility layer
7.5
CVE-2023-28431
Frontier is an Ethereum compatibility layer for Substrate
6.5
CVE-2022-36008
Frontier is Substrate's Ethereum compatibility layer
6.5
CVE-2022-21685
Frontier is Substrate's Ethereum compatibility layer
5.3
CVE-2022-39242
Frontier is an Ethereum compatibility layer for Substrate
