Vulnerability · Published Aug 5, 2022 · Assigned by mitre
CVE-2022-37450
Medium 5.9
In plain English
A medium-severity security flaw in the geth package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.9Medium
Exploit odds (30 days)1.3%top 30.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making (RUM), as exploited in the wild in 2020 through 2022.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | geth | 1.10.22-r0 | ALPINE-CVE-2022-37450 |
| Alpine:v3.21 | geth | 1.10.22-r0 | ALPINE-CVE-2022-37450 |
| Alpine:v3.22 | geth | 1.10.22-r0 | ALPINE-CVE-2022-37450 |
| Alpine:v3.23 | geth | 1.10.22-r0 | ALPINE-CVE-2022-37450 |
| Alpine:v3.24 | geth | 1.10.22-r0 | ALPINE-CVE-2022-37450 |
| Go | github.com/ethereum/go-ethereum | no fix listed | GHSA-rqmg-hrg4-fm69 |
Affected products (as reported)
References
- https://github.com/ethereum/go-ethereum/blob/671094279e8d27f4b4c3c94bf8b636c26b473976/core/forkchoice.go#L91-L94 x_refsource_MISC
- https://medium.com/%40aviv.yaish/uncle-maker-time-stamping-out-the-competition-in-ethereum-d27c1cb62fef x_refsource_MISC
- http://dx.doi.org/10.13140/RG.2.2.27813.99043 x_refsource_MISC
- https://news.ycombinator.com/item?id=32354896 x_refsource_MISC