CVE Vulnerability

CVE-2021-25837

Cosmos Network Ethermint <= v0.4.0 is affected by cache lifecycle inconsistency in the EVM module. Due to the inconsistency between the Storage caching cycle and the Tx processing cycle, Storage changes caused by a failed transaction are improperly reserved in memory. Although the bad storage cache data will be discarded at EndBlock, it is still valid in the current block, which enables many possible attacks such as an "arbitrary mint token".

5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

7.5 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/cosmos/ethermint/issues/667#issuecomment-759284107 Exploit Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:chainsafe:ethermint:*:*:*:*:*:*:*:*
Information

Published : 2021-02-08 06:15

Updated : 2021-02-12 01:54

NVD link : CVE-2021-25837

Mitre link : CVE-2021-25837

Products Affected
No products.
CWE
NVD-CWE-noinfo