U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

Vulnerability Change Records for CVE-2024-21629

Change History

New CVE Received from GitHub, Inc. 1/02/2024 5:15:09 PM

Action Type Old Value New Value
Added Description

								
							
							
						
Rust EVM is an Ethereum Virtual Machine interpreter. In `rust-evm`, a feature called `record_external_operation` was introduced, allowing library users to record custom gas changes. This feature can have some bogus interactions with the call stack. In particular, during finalization of a `CREATE` or `CREATE2`, in the case that the substack execution happens successfully, `rust-evm` will first commit the substate, and then call `record_external_operation(Write(out_code.len()))`. If `record_external_operation` later fails, this error is returned to the parent call stack, instead of `Succeeded`. Yet, the substate commitment already happened. This causes smart contracts able to commit state changes, when the parent caller contract receives zero address (which usually indicates that the execution has failed). This issue only impacts library users with custom `record_external_operation` that returns errors. The issue is patched in release 0.41.1. No known workarounds are available.
Added CVSS V3.1

								
							
							
						
GitHub, Inc. AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Added CWE

								
							
							
						
GitHub, Inc. CWE-703
Added Reference

								
							
							
						
GitHub, Inc. https://github.com/rust-ethereum/evm/blob/release-v041/src/executor/stack/executor.rs#L1012C25-L1012C69 [No types assigned]
Added Reference

								
							
							
						
GitHub, Inc. https://github.com/rust-ethereum/evm/commit/d8991ec727ad0fb64fe9957a3cd307387a6701e4 [No types assigned]
Added Reference

								
							
							
						
GitHub, Inc. https://github.com/rust-ethereum/evm/pull/264 [No types assigned]
Added Reference

								
							
							
						
GitHub, Inc. https://github.com/rust-ethereum/evm/security/advisories/GHSA-27wg-99g8-2v4v [No types assigned]