Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2022-39242— Incorrect Calculation in Frontier leads to inflated Ethereum chain gas prices

Quick assessment

Affected
paritytech frontier
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Frontier是一个 Substrate 的以太坊兼容层。用于运行未经修改的以太坊 Dapp。 Frontier存在安全漏洞，该漏洞源于最坏情况的权重总是作为所有情况的块权重。

CVSS 5.3 · Medium EPSS 0.76% · P54

Possible ATT&CK Techniques 1 AI

T1498 · Network Denial of Service
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2022-39242

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Incorrect Calculation in Frontier leads to inflated Ethereum chain gas prices
Source: CVE Program / CVE List V5
Vulnerability Description
Frontier is an Ethereum compatibility layer for Substrate. Prior to commit d3beddc6911a559a3ecc9b3f08e153dbe37a8658, the worst case weight was always accounted as the block weight for all cases. In case of large EVM gas refunds, this can lead to block spamming attacks -- the adversary can construct blocks with transactions that have large amount of refunds or unused gases with reverts, and as a result inflate up the chain gas prices. The impact of this issue is limited in that the spamming attack would still be costly for any adversary, and it has no ability to alter any chain state. This issue has been patched in commit d3beddc6911a559a3ecc9b3f08e153dbe37a8658. There are no known workarounds.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
数值计算不正确
Source: CVE Program / CVE List V5
Vulnerability Title
Frontier 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Frontier是一个 Substrate 的以太坊兼容层。用于运行未经修改的以太坊 Dapp。 Frontier存在安全漏洞，该漏洞源于最坏情况的权重总是作为所有情况的块权重。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
paritytech frontier < commit d3beddc6911a559a3ecc9b3f08e153dbe37a8658 -

II. Public POCs for CVE-2022-39242

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-39242

请登录查看更多情报信息。

Patches & Fixes for CVE-2022-39242 (1)

Vendor Advisories for CVE-2022-39242 (1)

IV. Related Vulnerabilities

Same product: frontier
Same vendor: paritytech
Same weakness: CWE-682

V. Comments for CVE-2022-39242

No comments yet

Leave a comment