CVE-2022-39242

MEDIUM Year: 2022
CVSS v3 Score
5.3
Medium
Weakness Type
CWE-682
View all →

Vulnerability Description

Frontier is an Ethereum compatibility layer for Substrate. Prior to commit d3beddc6911a559a3ecc9b3f08e153dbe37a8658, the worst case weight was always accounted as the block weight for all cases. In case of large EVM gas refunds, this can lead to block spamming attacks -- the adversary can construct blocks with transactions that have large amount of refunds or unused gases with reverts, and as a result inflate up the chain gas prices. The impact of this issue is limited in that the spamming attack would still be costly for any adversary, and it has no ability to alter any chain state. This issue has been patched in commit d3beddc6911a559a3ecc9b3f08e153dbe37a8658. There are no known workarounds.

Related Vulnerabilities

CVE-2016-7433

MEDIUM
CVSS:5.3(Medium)

NTP before 4.2.8p9 does not properly perform the initial sync calculations, which allows remote attackers to unspecified impact via unknown vectors, related to a "root distance that did not include th...

CWE-6822016

CVE-2017-5462

MEDIUM
CVSS:5.3(Medium)

A flaw in DRBG number generation within the Network Security Services (NSS) library where the internal state V does not correctly carry bits over. The NSS library has been updated to fix this issue to...

CWE-6822017

CVE-2020-26265

MEDIUM
CVSS:5.3(Medium)

Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. In Geth from version 1.9.4 and before version 1.9.20 a consensus-vulnerability could cause a chain split, where ...

CWE-6822020

CVE-2022-23001

MEDIUM
CVSS:5.3(Medium)

When compressing or decompressing elliptic curve points using the Sweet B library, an incorrect choice of sign bit is used. An attacker with user level privileges and no other user's assistance can ex...

CWE-6822022

CVE-2022-23028

MEDIUM
CVSS:5.3(Medium)

On BIG-IP AFM version 16.x before 16.1.0, 15.1.x before 15.1.5, 14.1.x before 14.1.4.5, and all versions of 13.1.x, when global AFM SYN cookie protection (TCP Half Open flood vector) is activated in t...

CWE-6822022

CVE-2022-23628

MEDIUM
CVSS:5.3(Medium)

OPA is an open source, general-purpose policy engine. Under certain conditions, pretty-printing an abstract syntax tree (AST) that contains synthetic nodes could change the logic of some statements by...

CWE-6822022