RUSTSEC-2022-0083 (CVE-2022-39354)
Vulnerability from osv_rustsec – Published: 2022-10-25 12:00 – Updated: 2023-02-02 11:20 – Source websiteSputnikVM, also called evm, is a Rust implementation of Ethereum Virtual Machine.
A custom stateful precompile can use the is_static parameter to determine if
the call is executed in a static context (via STATICCALL), and thus decide
if stateful operations should be done.
Prior to version 0.36.0, the passed is_static parameter was incorrect -- it
was only set to true if the call came from a direct STATICCALL opcode.
However, once a static call context is entered, it should stay static. The issue
only impacts custom precompiles that actually uses is_static.
For those affected, the issue can lead to possible incorrect state transitions.
| URL | Type | |
|---|---|---|
{
"affected": [
{
"database_specific": {
"categories": [
"crypto-failure"
],
"cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"informational": null
},
"ecosystem_specific": {
"affected_functions": null,
"affects": {
"arch": [],
"functions": [],
"os": []
}
},
"package": {
"ecosystem": "crates.io",
"name": "evm",
"purl": "pkg:cargo/evm"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0-0"
},
{
"fixed": "0.36.0"
}
],
"type": "SEMVER"
}
],
"versions": []
}
],
"aliases": [
"CVE-2022-39354",
"GHSA-hhc4-47rh-cr34"
],
"database_specific": {
"license": "CC0-1.0"
},
"details": "SputnikVM, also called evm, is a Rust implementation of Ethereum Virtual Machine.\n\nA custom stateful precompile can use the `is_static` parameter to determine if\nthe call is executed in a static context (via `STATICCALL`), and thus decide\nif stateful operations should be done.\n\nPrior to version 0.36.0, the passed `is_static` parameter was incorrect -- it\nwas only set to `true` if the call came from a direct `STATICCALL` opcode.\n\nHowever, once a static call context is entered, it should stay static. The issue\nonly impacts custom precompiles that actually uses `is_static`.\n\nFor those affected, the issue can lead to possible incorrect state transitions.",
"id": "RUSTSEC-2022-0083",
"modified": "2023-02-02T11:20:42Z",
"published": "2022-10-25T12:00:00Z",
"references": [
{
"type": "PACKAGE",
"url": "https://crates.io/crates/evm"
},
{
"type": "ADVISORY",
"url": "https://rustsec.org/advisories/RUSTSEC-2022-0083.html"
},
{
"type": "WEB",
"url": "https://github.com/rust-blockchain/evm/pull/133"
}
],
"related": [],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "evm incorrect state transition"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.