CVE-2022-35936
Description
Ethermint is an Ethereum library. In Ethermint running versions before `v0.17.2`, the contract `selfdestruct` invocation permanently removes the corresponding bytecode from the internal database storage. However, due to a bug in the `DeleteAccount`function, all contracts that used the identical bytecode (i.e shared the same `CodeHash`) will also stop working once one contract invokes `selfdestruct`, even though the other contracts did not invoke the `selfdestruct` OPCODE. This vulnerability has been patched in Ethermint version v0.18.0. The patch has state machine-breaking changes for applications using Ethermint, so a coordinated upgrade procedure is required. A workaround is available. If a contract is subject to DoS due to this issue, the user can redeploy the same contract, i.e. with identical bytecode, so that the original contract's code is recovered. The new contract deployment restores the `bytecode hash -> bytecode` entry in the internal state.
How to fix
- evmos ethermint0.18.0 or later
- kava kava0.18.0 or later
- evmos evmos7.0.0 or later
- github.com/evmos/ethermint0.18.0 or later
- github.com/evmos/evmos7.0.0 or later
- github.com/crypto-org-chain/cronos0.7.1-rc2 or later
- github.com/Kava-Labs/kava0.18.0 or later
- github.com/evmos/evmos/v77.0.0 or later
- github.com/kava-labs/kava0.18.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| evmos ethermint | v < 0.18.0 | 0.18.0 |
| kava kava | v < 0.18.0 | 0.18.0 |
| crypto cronos | v ≤ 0.7.0 | — |
| evmos evmos | v < 7.0.0 | 7.0.0 |
| github.com/evmos/ethermintGo | v < 0.18.0 | 0.18.0 |
| github.com/evmos/evmosGo | v < 7.0.0, No range specified | 7.0.0 |
| github.com/crypto-org-chain/cronosGo | v < 0.7.1-rc2 | 0.7.1-rc2 |
| github.com/Kava-Labs/kavaGo | v < 0.18.0 | 0.18.0 |
| github.com/evmos/evmos/v2Go | No range specified | — |
| github.com/evmos/evmos/v3Go | No range specified | — |
| github.com/evmos/evmos/v4Go | No range specified | — |
| github.com/evmos/evmos/v5Go | No range specified | — |
| github.com/evmos/evmos/v6Go | No range specified | — |
| github.com/evmos/evmos/v7Go | v < 7.0.0 | 7.0.0 |
| github.com/kava-labs/kavaGo | v < 0.18.0 | 0.18.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.