CVE-2022-21685 : What You Need to Know

Frontier is Substrate's Ethereum compatibility layer which contained a bug in the MODEXP precompile implementation. This bug could lead to an integer underflow, causing a node crash for debug builds or an EVM out-of-gas issue for release builds. Users not utilizing MODEXP precompile are unaffected. The vulnerability has a CVSS base score of 6.5 (Medium).

Understanding CVE-2022-21685

Frontier, developed by Parity Technologies, suffered from an integer underflow vulnerability that could affect certain builds of the software.

What is CVE-2022-21685?

The CVE-2022-21685 vulnerability in Frontier revolves around an integer underflow in the MODEXP precompile implementation that could lead to a node crash in debug builds or an EVM out-of-gas issue in release builds.

The Impact of CVE-2022-21685

The impact of this vulnerability is limited for release builds and production WebAssembly binaries as it only causes a normal EVM out-of-gas scenario. However, for debug builds, it can result in a node crash.

Technical Details of CVE-2022-21685

The vulnerability is classified under CWE-191: Integer Underflow (Wrap or Wraparound).

Vulnerability Description

Prior to commit number

8a93fdc6c9f4eb1d2f2a11b7ff1d12d70bf5a664

, the integer underflow in the MODEXP precompile implementation could occur under specific conditions.

Affected Systems and Versions

The affected product is Frontier by Parity Technologies with versions prior to commit number

8a93fdc6c9f4eb1d2f2a11b7ff1d12d70bf5a664

.

Exploitation Mechanism

The vulnerability can be exploited by triggering the integer underflow in the MODEXP precompile implementation.

Mitigation and Prevention

To address CVE-2022-21685, users are advised to take immediate steps and adopt long-term security practices.

Immediate Steps to Take

Apply the available patch in pull request #549 to mitigate the vulnerability.

Long-Term Security Practices

Regularly update the software and follow security best practices to minimize risks.

Patching and Updates

Stay informed about security updates released by Parity Technologies to prevent exploitation of this vulnerability.