Headline
GHSA-mv8x-668m-53fg: Elrond-go has improper initialization
Impact
Read only calls between contracts can generate smart contracts results. For example, if contract A calls in read only mode contract B and the called function will make changes upon the contract’s B state, the state will be altered for contract B as if the call was not made in the read-only mode. This can lead to some effects not designed by the original smart contracts programmers.
Patches
Patch v1.3.35 or higher
Workarounds
No workaround
References
For future reference and understanding of this issue, anyone can check this integration test https://github.com/ElrondNetwork/elrond-go/blob/8e402fa6d7e91e779980122d3798b2bf50892945/integrationTests/vm/txsFee/asyncESDT_test.go#L452 that proves the fix and prevents a future code regression.
For more information
If you have any questions or comments about this advisory:
- Open an issue in elrond-go (http://github.com/ElrondNetwork/elrond-go/issues)
Elrond-go has improper initialization
Critical severity GitHub Reviewed Published Sep 16, 2022 in ElrondNetwork/elrond-go • Updated Sep 16, 2022
Package
gomod github.com/ElrondNetwork/elrond-go (Go)
Affected versions
<= 1.3.34
Patched versions
1.3.35
Description
Impact
Read only calls between contracts can generate smart contracts results. For example, if contract A calls in read only mode contract B and the called function will make changes upon the contract’s B state, the state will be altered for contract B as if the call was not made in the read-only mode. This can lead to some effects not designed by the original smart contracts programmers.
Patches
Patch v1.3.35 or higher
Workarounds
No workaround
References
For future reference and understanding of this issue, anyone can check this integration test https://github.com/ElrondNetwork/elrond-go/blob/8e402fa6d7e91e779980122d3798b2bf50892945/integrationTests/vm/txsFee/asyncESDT_test.go#L452 that proves the fix and prevents a future code regression.
For more information
If you have any questions or comments about this advisory:
- Open an issue in elrond-go (http://github.com/ElrondNetwork/elrond-go/issues)
References
- GHSA-mv8x-668m-53fg
- https://nvd.nist.gov/vuln/detail/CVE-2022-36061
- https://github.com/ElrondNetwork/elrond-go/blob/8e402fa6d7e91e779980122d3798b2bf50892945/integrationTests/vm/txsFee/asyncESDT_test.go#L452
- https://github.com/ElrondNetwork/elrond-go/releases/tag/v1.3.35
iulianpascalau published the maintainer security advisory
Aug 29, 2022
Severity
Critical
9.8
/ 10
CVSS base metrics
Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-665
CVE ID
CVE-2022-36061
GHSA ID
GHSA-mv8x-668m-53fg
Source code
ElrondNetwork/elrond-go
Checking history
See something to contribute? Suggest improvements for this vulnerability.
Related news
Elrond go is the go implementation for the Elrond Network protocol. In versions prior to 1.3.35, read only calls between contracts can generate smart contracts results. For example, if contract A calls in read only mode contract B and the called function will make changes upon the contract's B state, the state will be altered for contract B as if the call was not made in the read-only mode. This can lead to some effects not designed by the original smart contracts programmers. This issue was patched in version 1.3.35. There are no known workarounds.