{"id":"CVE-2020-26241","published":"2020-11-25T01:25:20Z","modified":"2024-08-04T15:56:03Z","title":"Shallow copy bug in geth","vendor":"ethereum","product":"go-ethereum","tier":"tail","description":{"text":"Go Ethereum, or \"Geth\", is the official Golang implementation of the Ethereum protocol. This is a Consensus vulnerability in Geth before version 1.9.17 which can be used to cause a chain-split where vulnerable nodes reject the canonical chain. Geth's pre-compiled dataCopy (at 0x00...04) contract did a shallow copy on invocation. An attacker could deploy a contract that writes X to an EVM memory region R, then calls 0x00..04 with R as an argument, then overwrites R to Y, and finally invokes the RETURNDATACOPY opcode. When this contract is invoked, a consensus-compliant node would push X on the EVM stack, whereas Geth would push Y. This is fixed in version 1.9.17.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01226,"percentile":0.6877,"provenance":"source"},"cwes":[{"id":"CWE-682","name":"Incorrect Calculation"}],"references":[{"url":"https://blog.ethereum.org/2020/11/12/geth_security_release/","tags":["x_refsource_MISC"]},{"url":"https://github.com/ethereum/go-ethereum/security/advisories/GHSA-69v6-xc2j-r2jf","tags":["x_refsource_CONFIRM"]}],"priority":{"score":18.3,"factors":[{"name":"EPSS percentile","points":13.75},{"name":"CVSS severity","points":4.55}]},"vendorSlug":"ethereum","affectedVersions":[{"vendor":"ethereum","product":"go-ethereum","versions":[">= 1.9.7, < 1.9.17"]}],"affected":[{"ecosystem":"Go","package":"github.com/ethereum/go-ethereum","vulnerableRanges":[">=1.9.7, <1.9.17"],"patched":["1.9.17"],"from":["GHSA-69v6-xc2j-r2jf","GO-2022-0771"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-1275","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-ethereum-go-ethereum-cve-2018-19184","parents":[{"from":"CVE-2018-19184","to":"CVE-2020-26241","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["cmd/evm/runner.go","cmd/evm/staterunner.go"],"commits":["https://github.com/ethereum/go-ethereum/commit/83e2761c3a13524bd5d6597ac08994488cf872ef","https://github.com/ethereum/go-ethereum/commit/fb9f7261ec51e38eedb454594fc19f00de1a6834","https://github.com/ethereum/go-ethereum/commit/295693759e5ded05fec0b2fb39359965b60da785"],"basis":"shared function","functions":["runCmd","stateTestCmd"]}]}],"children":[{"from":"CVE-2020-26241","to":"CVE-2020-26265","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["core/state/statedb.go","trie/secure_trie.go"],"commits":["https://github.com/ethereum/go-ethereum/commit/295693759e5ded05fec0b2fb39359965b60da785","https://github.com/ethereum/go-ethereum/commit/87c0ba92136a75db0ab2aba1046d4a9860375d6a"],"basis":"rarely changed file"}]},{"from":"CVE-2020-26241","to":"CVE-2021-39137","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["core/vm/instructions.go","core/vm/interpreter.go"],"commits":["https://github.com/ethereum/go-ethereum/commit/295693759e5ded05fec0b2fb39359965b60da785","https://github.com/ethereum/go-ethereum/commit/4d4879cafd1b3c906fc184a8c4a357137465128f"],"basis":"shared function","functions":["Run","opCall","opCallCode"]}]}],"packageHistory":[{"cve":"CVE-2018-12018","published":"2018-07-05","fixed":"1.8.11","kev":false},{"cve":"CVE-2018-16733","published":"2018-09-08","fixed":"1.8.14","kev":false},{"cve":"CVE-2018-19184","published":"2018-11-12","fixed":"1.8.14","kev":false},{"cve":"CVE-2020-26241","published":"2020-11-25","fixed":"1.9.17","kev":false},{"cve":"CVE-2020-26242","published":"2020-11-25","fixed":"1.9.18","kev":false,"link":{"from":"CVE-2020-26241","to":"CVE-2020-26242","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/ethereum/go-ethereum","fromFixed":"1.9.17","toFixed":"1.9.18","daysApart":0}]}},{"cve":"CVE-2020-26265","published":"2020-12-11","fixed":"1.9.20","kev":false},{"cve":"CVE-2020-26240","published":"2020-11-25","fixed":"1.9.24","kev":false}],"package":"Go:github.com/ethereum/go-ethereum"}}