GHSA-rqmg-hrg4-fm69

Go Ethereum allows attackers to use manipulation of time-difference values to achieve replacement of main-chain blocks

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-37450

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/ethereum/go-ethereum	<= 1.10.21	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making (RUM), as exploited in the wild in 2020 through 2022.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-37450 advisory
https://github.com/ethereum/go-ethereum package
https://github.com/ethereum/go-ethereum/blob/671094279e8d27f4b4c3c94bf8b636c26b473976/core/forkchoice.go#L91-L94 web
https://medium.com/@aviv.yaish/uncle-maker-time-stamping-out-the-competition-in-ethereum-d27c1cb62fef web
https://news.ycombinator.com/item?id=32354896 web
http://dx.doi.org/10.13140/RG.2.2.27813.99043 web