| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/ethereum/go-ethereum | ≥ 1.9.7, < 1.9.17 | 1.9.17 |
| go ethereum | < 1.9.17 | 1.9.17 |
This is a Consensus vulnerability, which can be used to cause a chain-split where vulnerable nodes reject the canonical chain.
Geth’s pre-compiled dataCopy (at 0x00...04) contract did a shallow copy on invocation. An attacker could deploy a contract that
X to an EVM memory region R,0x00..04 with R as an argument,R to Y,RETURNDATACOPY opcode.When this contract is invoked, a consensus-compliant node would push X on the EVM stack, whereas Geth would push Y.
No standalone patches have been made.
Upgrade to 1.9.17 or higher.
https://blog.ethereum.org/2020/11/12/geth_security_release/
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free