GitHub Advisoryadvisory · crates.io
GHSA-773q-5334-5gf9 Memory over-allocation in evm-core
MEDIUM
Official page ↗
- Ecosystem
- crates.io
- Packages
- evm-core
- Severity
- Moderate
- Weaknesses
- CWE-789
- Reviewed
- 2021-08-18
Affected packages
• crates.io evm-core: >= 0.26.0, < 0.26.1 → fixed in 0.26.1
• crates.io evm-core: >= 0.25.0, < 0.25.1 → fixed in 0.25.1
• crates.io evm-core: >= 0.24.0, < 0.24.1 → fixed in 0.24.1
• crates.io evm-core: >= 0.23.0, < 0.23.1 → fixed in 0.23.1
• crates.io evm-core: < 0.21.1 → fixed in 0.21.1
Description
Prior to the patch, when executing specific EVM opcodes related
to memory operations that use `evm_core::Memory::copy_large`, the
crate can over-allocate memory when it is not needed, making it
possible for an attacker to perform denial-of-service attack.
The flaw was corrected in commit `19ade85`.
Related
Weakness · CWE (1)
- CWE-789 Memory Allocation with Excessive Size Value weakness