Executive brief
A vulnerability in the EthereumJS virtual machine library could allow an attacker to cause a denial of service. This library is used to execute Ethereum smart contracts; an exploit could cause the virtual machine to fail or stop processing transactions correctly. This may impact the availability of services relying on this specific JavaScript implementation of the Ethereum protocol.
Technical details
A denial of service vulnerability exists in ethereumjs-vm version 2.4.0 and earlier. The flaw is triggered when processing a specific 'code' attribute using 'Buffer.from(my_code, 'hex')', which can lead to a 'vm.runCode' failure and a REVERT state. While NVD associates this with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), the vendor has disputed the severity, noting that REVERT is a standard EVM bytecode instruction. An attacker can exploit this over the network without authentication to disrupt the execution of smart contracts within the VM.
Affected products
- EthereumJS ethereumjs-vm <= 2.4.0
Timeline
- 2018-11-11: advisory: NVD published date
- 2018-11-21: disclosed: GitHub Advisory published
- 2024-03-20: other: MITRE added 'disputed' tag to the CVE record