CVE-2021-39137: Consensus flaw during block processing in go-ethereum
Impact
A vulnerability in the Geth EVM could cause a node to reject the canonical chain.
Description
A memory-corruption bug within the EVM can cause a consensus error, where vulnerable nodes obtain a different stateRoot when processing a maliciously crafted transaction. This, in turn, would lead to the chain being split in two forks.
All Geth versions supporting the London hard fork are vulnerable (which predates London), so all users should update.
This bug was exploited on Mainnet at block 13107518, leading to a minority chain split.
Patches
A patch is included in the v1.10.8 release. The exact patch to fix the issue is contained within this commit
Workarounds
No workarounds exist, save to update and/or apply the patch commit.
References.
Post-mortem write-up.
Credits
The bug was found by @guidovranken (working for Sentnl during an audit of the Telos EVM) and reported via bounty@ethereum.org.
For more information If you have any questions or comments about this advisory:
Open an issue in go-ethereum Email us at security@ethereum.org
Other sources
go-ethereum is the official Go implementation of the Ethereum protocol. In affected versions a consensus-vulnerability in go-ethereum (Geth) could cause a chain split, where vulnerable versions refuse to accept the canonical chain. Further details about the vulnerability will be disclosed at a later date. A patch is included in the upcoming v1.10.8 release. No workaround are available.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/ethereum/go-ethereumto a version that resolves this vulnerability.Fixed in 1.10.8 - Upgrade
Upgrade
go-ethereumto a version that resolves this vulnerability.Fixed in v1.10.8 - Compensating control
No workaround is available for this consensus flaw; rely on updating to v1.10.8 (or applying the referenced patch commit) to prevent chain splits where vulnerable versions refuse to accept the canonical chain.
Event History
Frequently Asked Questions
What is the severity of CVE-2021-39137?
CVE-2021-39137 is considered a high severity vulnerability due to its potential to cause consensus errors in Ethereum nodes.
How do I fix CVE-2021-39137?
To fix CVE-2021-39137, update your Geth EVM software to version 1.10.8 or later.
What does CVE-2021-39137 affect?
CVE-2021-39137 affects the Geth implementation of Ethereum's EVM, specifically versions from 1.10.0 to 1.10.8.
What kind of vulnerability is CVE-2021-39137?
CVE-2021-39137 is a memory-corruption vulnerability that can lead to chain rejection in Ethereum nodes.
Can CVE-2021-39137 be exploited remotely?
Yes, CVE-2021-39137 can potentially be exploited remotely by crafting malicious transactions.