CVE-2022-36025 : What You Need to Know
Discover the impact of CVE-2022-36025 on Besu, a Java-based Ethereum client. Learn how the Incorrect Conversion between Numeric Types bug affects gas calculations and can lead to consensus failures.
Besu, a Java-based Ethereum client, versions newer than 22.1.3 and prior to 22.7.1, is vulnerable to an Incorrect Conversion between Numeric Types, affecting gas calculations in CALL operations. This leads to consensus failure and potential gas limit breaches.
Understanding CVE-2022-36025
This CVE highlights a critical vulnerability in the Besu Ethereum client that can result in incorrect execution due to errors in gas calculations.
What is CVE-2022-36025?
Besu versions > 22.1.3, < 22.7.1 are affected by an Incorrect Conversion between Numeric Types, impacting gas handling in CALL operations. This can lead to consensus failures in networks with multiple EVM implementations.
The Impact of CVE-2022-36025
The vulnerability allows executing transactions with significantly more gas than requested, potentially surpassing gas limitations and causing consensus failures.
Technical Details of CVE-2022-36025
This section includes a detailed overview of the vulnerability.
Vulnerability Description
Besu's miscalculation in available gas in CALL operations results in passing incorrect gas to called contracts, affecting consensus and leading to unexpected state roots.
Affected Systems and Versions
Besu versions > 22.1.3, < 22.7.1 are impacted by this vulnerability related to numeric type conversions in gas calculations.
Exploitation Mechanism
Attackers can exploit this vulnerability to execute transactions with excessive gas, potentially breaching gas limits and causing consensus failures.
Mitigation and Prevention
Discover how to address and prevent the vulnerability in Besu.
Immediate Steps to Take
To mitigate the risk, update to Besu version 22.7.1 or implement a workaround by reverting to version 22.1.3 or earlier.
Long-Term Security Practices
Ensure continuous monitoring for updates and vulnerabilities in Besu to maintain a secure environment.
Patching and Updates
Stay informed about security patches and updates released by Hyperledger to safeguard against potential security risks.