CVE-2022-31170: OpenZeppelin Contracts ERC165Checker revert on invalid interface response

CVE-2022-31170 · Severity: low · CVSS 3.1 · Published 2022-07-21

OpenZeppelin Contracts is a widely-used library providing secure implementations of Ethereum smart contract standards. The ERC165Checker utility is designed to safely verify whether a smart contract supports a given interface; however, a flaw in how it decodes responses can cause it to revert instead of returning false when checking contracts that return malformed interface support responses. Applications relying on this utility to gracefully handle unsupported interfaces may crash unexpectedly, disrupting contract interactions and potentially enabling denial-of-service attacks.

Technologies: @openzeppelin/contracts (npm), @openzeppelin/contracts-upgradeable (npm), OpenZeppelin Contracts, OpenZeppelin Contracts Upgradeable. Vendors: npm, OpenZeppelin.

Quick answers

Is CVE-2022-31170 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2022-31170 being exploited in the wild.
How severe is CVE-2022-31170?
Low severity, with a CVSS score of 3.1, published 21 July 2022.
Which products and versions are affected?
@openzeppelin/contracts (npm) SEMVER:introduced=4.0.0,fixed=4.7.1; @openzeppelin/contracts-upgradeable (npm) SEMVER:introduced=4.0.0,fixed=4.7.1; OpenZeppelin Contracts >=4.0.0, <4.7.1; OpenZeppelin Contracts Upgradeable >=4.0.0, <4.7.1.
Is there a fix for CVE-2022-31170?
Yes. @openzeppelin/contracts (npm): upgrade to 4.7.1 or later; @openzeppelin/contracts-upgradeable (npm): upgrade to 4.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-31170 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2022-31170?
Check whether you run @openzeppelin/contracts (npm), @openzeppelin/contracts-upgradeable (npm), OpenZeppelin Contracts or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @openzeppelin/contracts (npm): upgrade to 4.7.1 or later
    npm install @openzeppelin/contracts@4.7.1
  • @openzeppelin/contracts-upgradeable (npm): upgrade to 4.7.1 or later
    npm install @openzeppelin/contracts-upgradeable@4.7.1

Technical details

The ERC165Checker.supportsInterface function in OpenZeppelin Contracts (versions 4.0.0 to 4.7.0) contains a logic error in how it uses Solidity 0.8's abi.decode to process interface support responses. The function makes an incorrect assumption about the return value handling, causing it to revert when a target contract returns a value other than 0 or 1 (the only valid boolean encodings), rather than gracefully returning false. This occurs during low-level ABI decoding and affects any contract that relies on ERC165Checker to safely probe for interface support without reverting. Applications using ERC165Checker to handle graceful fallback logic when interface support is absent become vulnerable to denial of service, as the probe itself may crash. The vulnerability was patched in version 4.7.1.

Affected products

  • OpenZeppelin Contracts >=4.0.0, <4.7.1
  • OpenZeppelin Contracts Upgradeable >=4.0.0, <4.7.1

Identifiers

  • CVE-2022-31170
  • GHSA-qh9x-gcfh-pcrw

Timeline

  • 2022-07-21: disclosed: Vulnerability disclosed via GitHub Security Advisory GHSA-qh9x-gcfh-pcrw
  • 2022-07-21: patched: Fixed in OpenZeppelin Contracts 4.7.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.