CVE-2022-35936 (published 2022-08-05T13:15Z)

Ethermint is an Ethereum library. In Ethermint running versions before `v0.17.2`, the contract `selfdestruct` invocation permanently removes the corresponding bytecode from the internal database storage. However, due to a bug in the `DeleteAccount`function, all contracts that used the identical bytecode (i.e shared the same `CodeHash`) will also stop working once one contract invokes `selfdestruct`, even though the other contracts did not invoke the `selfdestruct` OPCODE. This vulnerability has been patched in Ethermint version v0.18.0. The patch has state machine-breaking changes for applications using Ethermint, so a coordinated upgrade procedure is required. A workaround is available. If a contract is subject to DoS due to this issue, the user can redeploy the same contract, i.e. with identical bytecode, so that the original contract's code is recovered. The new contract deployment restores the `bytecode hash -> bytecode` entry in the internal state.

CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Weakness information:
cwe_id: CWE-668
cwe_name: Exposure of Resource to Wrong Sphere
description: The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
extended_description: 
            Resources such as files and directories may be inadvertently exposed through mechanisms such as insecure permissions, or when a program accidentally operates on the wrong object. For example, a program may intend that private files can only be provided to a specific user. This effectively defines a control sphere that is intended to prevent attackers from accessing these private files. If the file permissions are insecure, then parties other than the user will be able to access those files.
            A separate control sphere might effectively require that the user can only access the private files, but not any other files on the system. If the program does not ensure that the user is only requesting private files, then the user might be able to access other files on the system.
            In either case, the end result is that a resource has been exposed to the wrong party.
         
         

Fix information:
repo_url: https://github.com/evmos/ethermint
commit_details: repo_url: https://github.com/evmos/ethermint
author: Freddy Caceres
author_date: 2022-08-04 15:47:01-04:00
msg: Merge pull request from GHSA-f92v-grc2-w2fg

* remove delete code in DeleteAccount

* update unit test

* refactor test

Co-authored-by: Federico Kunze Küllmer <31522760+fedekunze@users.noreply.github.com>
repository: repo_url: https://github.com/evmos/ethermint
repo_name: evmos/ethermint
description: Ethermint is a Cosmos SDK library for running scalable and interoperable EVM chains
repo_language: Go
owner: evmos
file_changes: filename: statedb.go
change_type: ModificationType.MODIFY
diff: @@ -1,7 +1,6 @@
 package keeper
 
 import (
-	"bytes"
 	"fmt"
 	"math/big"
 
@@ -186,7 +185,7 @@ func (k *Keeper) DeleteAccount(ctx sdk.Context, addr common.Address) error {
 	}
 
 	// NOTE: only Ethereum accounts (contracts) can be selfdestructed
-	ethAcct, ok := acct.(ethermint.EthAccountI)
+	_, ok := acct.(ethermint.EthAccountI)
 	if !ok {
 		return sdkerrors.Wrapf(types.ErrInvalidAccount, "type %T, address %s", acct, addr)
 	}
@@ -196,12 +195,6 @@ func (k *Keeper) DeleteAccount(ctx sdk.Context, addr common.Address) error {
 		return err
 	}
 
-	// remove code
-	codeHashBz := ethAcct.GetCodeHash().Bytes()
-	if !bytes.Equal(codeHashBz, types.EmptyCodeHash) {
-		k.SetCode(ctx, codeHashBz, nil)
-	}
-
 	// clear storage
 	k.ForEachStorage(ctx, addr, func(key, _ common.Hash) bool {
 		k.SetState(ctx, addr, key, nil)

programming_language: Go
filename: statedb_test.go
change_type: ModificationType.MODIFY
diff: @@ -15,6 +15,7 @@ import (
 	ethtypes "github.com/ethereum/go-ethereum/core/types"
 	"github.com/ethereum/go-ethereum/core/vm"
 	"github.com/ethereum/go-ethereum/crypto"
+	"github.com/evmos/ethermint/crypto/ethsecp256k1"
 	"github.com/evmos/ethermint/tests"
 	"github.com/evmos/ethermint/x/evm/statedb"
 	"github.com/evmos/ethermint/x/evm/types"
@@ -420,12 +421,26 @@ func (suite *KeeperTestSuite) TestSuicide() {
 	suite.Require().NoError(db.Commit())
 	db = suite.StateDB()
 
+	// Generate 2nd address
+	privkey, _ := ethsecp256k1.GenerateKey()
+	key, err := privkey.ToECDSA()
+	suite.Require().NoError(err)
+	addr2 := crypto.PubkeyToAddress(key.PublicKey)
+
+	// Add code and state to account 2
+	db.SetCode(addr2, code)
+	suite.Require().Equal(code, db.GetCode(addr2))
+	for i := 0; i < 5; i++ {
+		db.SetState(addr2, common.BytesToHash([]byte(fmt.Sprintf("key%d", i))), common.BytesToHash([]byte(fmt.Sprintf("value%d", i))))
+	}
+
 	// Call Suicide
 	suite.Require().Equal(true, db.Suicide(suite.address))
 
 	// Check suicided is marked
 	suite.Require().Equal(true, db.HasSuicided(suite.address))
 
+	// Commit state
 	suite.Require().NoError(db.Commit())
 	db = suite.StateDB()
 
@@ -441,6 +456,10 @@ func (suite *KeeperTestSuite) TestSuicide() {
 
 	// Check account is deleted
 	suite.Require().Equal(common.Hash{}, db.GetCodeHash(suite.address))
+
+	// Check code is still present in addr2 and suicided is false
+	suite.Require().NotNil(db.GetCode(addr2))
+	suite.Require().Equal(false, db.HasSuicided(addr2))
 }
 
 func (suite *KeeperTestSuite) TestExist() {

programming_language: Go