CVE-2022-21685— Integer underflow in Frontier
Quick assessment
Affected
paritytech frontier
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Frontier是一个 Substrate 的以太坊兼容层。用于运行未经修改的以太坊 Dapp。 Frontier 中存在数字错误漏洞，该漏洞源于Frontier 的 MODEXP 预编译实现中的一个错误可能会在某些情况下导致整数下溢。这将导致调试构建的节点崩溃。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-21685
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Integer underflow in Frontier
Source: CVE Program / CVE List V5
Vulnerability Description
Frontier is Substrate's Ethereum compatibility layer. Prior to commit number `8a93fdc6c9f4eb1d2f2a11b7ff1d12d70bf5a664`, a bug in Frontier's MODEXP precompile implementation can cause an integer underflow in certain conditions. This will cause a node crash for debug builds. For release builds (and production WebAssembly binaries), the impact is limited as it can only cause a normal EVM out-of-gas. Users who do not use MODEXP precompile in their runtime are not impacted. A patch is available in pull request #549.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
整数下溢(超界折返)
Source: CVE Program / CVE List V5
Vulnerability Title
Frontier 数字错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Frontier是一个 Substrate 的以太坊兼容层。用于运行未经修改的以太坊 Dapp。 Frontier 中存在数字错误漏洞，该漏洞源于Frontier 的 MODEXP 预编译实现中的一个错误可能会在某些情况下导致整数下溢。这将导致调试构建的节点崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| paritytech | frontier | < 8a93fdc | - |
|
II. Public POCs for CVE-2022-21685
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-21685
请登录查看更多情报信息。
Patches & Fixes for CVE-2022-21685 (2)
-
https://github.com/paritytech/frontier/pull/549 x_refsource_MISC
Vendor Advisories for CVE-2022-21685 (1)
-
https://github.com/paritytech/frontier/security/advisories/GHSA-cjg2-2fjg-fph4 x_refsource_CONFIRM
IV. Related Vulnerabilities
Same product: frontier
-
CVE-2025-54429
Polkadot Frontier's constructing smart contract can bypass p -
CVE-2025-54427
Polkadot Frontier contains missing `check_inherent` for `not -
CVE-2025-54426
Polkadot Frontier contains silent failure in Curve25519 arit -
CVE-2023-45130
Frontier opcode SUICIDE touches too many storage values on l -
CVE-2023-28431
Frontier's modexp precompile is slow for even modulus
Same vendor: paritytech
-
CVE-2023-45130
Frontier opcode SUICIDE touches too many storage values on l -
CVE-2023-34449
ink! vulnerable to incorrect decoding of storage value when -
CVE-2023-28431
Frontier's modexp precompile is slow for even modulus -
CVE-2022-39242
Incorrect Calculation in Frontier leads to inflated Ethereum -
CVE-2022-36008
Message length overflow in frontier
Same weakness: CWE-191
-
CVE-2026-73252
Mongoose: Unauthenticated remote heap out-of-bounds read in -
CVE-2026-86566
Dpdk: dpdk: guest with runt rx descriptors underflows copy l -
CVE-2026-75083
Integer underflow of the radio-reported frame length causes -
CVE-2026-101968
Junos OS and Junos OS Evolved: EX Series, MX Series, ACX Ser -
CVE-2026-101938
Junos OS and Junos OS Evolved: SRX Series: An attacker cause
V. Comments for CVE-2022-21685
No comments yet