8000 x/vulndb: potential Go vuln in github.com/ethereum/go-ethereum/core/vm: GHSA-69v6-xc2j-r2jf · Issue #1332 · golang/vulndb · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

x/vulndb: potential Go vuln in github.com/ethereum/go-ethereum/core/vm: GHSA-69v6-xc2j-r2jf #1332

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
GoVulnBot opened this issue Jan 9, 2023 · 1 comment
Closed

x/vulndb: potential Go vuln in github.com/ethereum/go-ethereum/core/vm: GHSA-69v6-xc2j-r2jf #1332

GoVulnBot opened this issue Jan 9, 2023 · 1 comment
Labels
duplicate

Comments

@GoVulnBot
Copy link

In GitHub Security Advisory GHSA-69v6-xc2j-r2jf, there is a vulnerability in the following Go packages or modules:

Unit Fixed Vulnerable Ranges
github.com/ethereum/go-ethereum/core/vm 1.19.7 < 1.19.7

Cross references:

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: TODO
    versions:
      - fixed: 1.19.7
    packages:
      - package: github.com/ethereum/go-ethereum/core/vm
  - module: TODO
    versions:
      - introduced: 1.9.7
        fixed: 1.9.17
    packages:
      - package: github.com/ethereum/go-ethereum
description: "### Impact\nThis is a Consensus vulnerability, which can be used to
    cause a chain-split where vulnerable nodes reject the canonical chain. \n\nGeth’s
    pre-compiled `dataCopy` (at `0x00...04`) contract did a shallow copy on invocation.
    An attacker could deploy a contract that \n\n- writes `X` to an EVM memory region
    `R`,\n- calls `0x00..04` with `R` as an argument,\n- overwrites `R` to `Y`,\n-
    and finally invokes the `RETURNDATACOPY` opcode.\n\nWhen this contract is invoked,
    a consensus-compliant node would push `X` on the EVM stack, whereas Geth would
    push `Y`.\n\n### For more information\nIf you have any questions or comments about
    this advisory:\n* Open an issue in [go-ethereum](https://github.com/ethereum/go-ethereum)\n*
    Email us at [security@ethereum.org](mailto:security@ethereum.org)"
cves:
  - CVE-2020-26241
ghsas:
  - GHSA-69v6-xc2j-r2jf
@tatianab
Copy link
Contributor
tatianab commented Jan 9, 2023

Duplicate of #771

@tatianab tatianab closed this as completed Jan 9, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
duplicate
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@tatianab @GoVulnBot
0