What is GHSA-773q-5334-5gf9?

GHSA-773q-5334-5gf9 is a security advisory published by GitHub Security Advisories with Medium severity. Memory over-allocation in evm-core

Why does GHSA-773q-5334-5gf9 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-773q-5334-5gf9?

GHSA-773q-5334-5gf9 affects 5 products, including: rust/evm-core:\u003e= 0.26.0, \u003c 0.26.1; rust/evm-core:\u003e= 0.25.0, \u003c 0.25.1; rust/evm-core:\u003e= 0.24.0, \u003c 0.24.1; rust/evm-core:\u003e= 0.23.0, \u003c 0.23.1; rust/evm-core:\u003c 0.21.1.

GHSA-773q-5334-5gf9MediumDisclosed before NVD

Memory over-allocation in evm-core

Vendor

GitHub Security Advisories

Published

August 25, 2021

Last Modified

June 13, 2023

📋 Description

Prior to the patch, when executing specific EVM opcodes related to memory operations that use evm_core::Memory::copy_large, the crate can over-allocate memory when it is not needed, making it possible for an attacker to perform denial-of-service attack.

The flaw was corrected in commit 19ade85.

🎯 Affected products5

rust/evm-core:>= 0.26.0, < 0.26.1
rust/evm-core:>= 0.25.0, < 0.25.1
rust/evm-core:>= 0.24.0, < 0.24.1
rust/evm-core:>= 0.23.0, < 0.23.1
rust/evm-core:< 0.21.1

🔗 References (4)

https://github.com/rust-blockchain/evm/commit/19ade85
https://rustsec.org/advisories/RUSTSEC-2021-0066.html
https://github.com/rust-blockchain/evm
https://github.com/advisories/GHSA-773q-5334-5gf9