CVE-2021-29511
Summary
| CVE | CVE-2021-29511 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2021-05-12 18:15:00 UTC |
|---|
| Updated | 2022-10-25 19:13:00 UTC |
|---|
| Description | evm is a pure Rust implementation of Ethereum Virtual Machine. Prior to the patch, when executing specific EVM opcodes related to memory operations that use `evm_core::Memory::copy_large`, the `evm` crate can over-allocate memory when it is not needed, making it possible for an attacker to perform denial-of-service attack. The flaw was corrected in commit `19ade85`. Users should upgrade to `==0.21.1, ==0.23.1, ==0.24.1, ==0.25.1, >=0.26.1`. There are no workarounds. Please upgrade your `evm` crate version. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Skip setting memory value if the value vec is empty · rust-blockchain/evm@19ade85 · GitHub |
MISC |
github.com |
|
| Memory over-allocation in evm crate · Advisory · rust-blockchain/evm · GitHub |
CONFIRM |
github.com |
|
| crates.io/crates/evm |
MISC |
crates.io |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 997013 Rust (Rust) Security Update for evm (GHSA-4jwq-572w-4388)
