Validity check for signed Frontier-specific extrinsic not called in block execution
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Frontier is Substrate's Ethereum compatibility layer. In the newly introduced signed Frontier-specific extrinsic for `pallet-ethereum`, a large part of transaction validation logic was only called in transaction pool validation, but not in block execution. Malicious validators can take advantage of this to put invalid transactions into a block. The attack is limited in that the signature is always validated, and the majority of the validation is done again in the subsequent `pallet-evm` execution logic. However, do note that a chain ID replay attack was possible. In addition, spamming attacks are of main concerns, while they are limited by Substrate block size limits and other factors. The issue is patched in commit `146bb48849e5393004be5c88beefe76fdf009aba`.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| paritytech | frontier | before 146bb48 | 146bb48 | Patch available | CNA |
| — | pallet-ethereum (crates.io) | up to 3.0.0 | — | No fix listed | GHSA-vj62-g63v-f8mf |
- frontier Vendorparitytech Affected before 146bb48 Fixed in 146bb48 Patch available CNA
- pallet-ethereum (crates.io) Vendor— Affected up to 3.0.0 Fixed in — No fix listed GHSA-vj62-g63v-f8mf
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:parity:frontier:*:*:*:*:*:*:*:* | 2021-09-30 to before 2021-10-13 | Vulnerable | paritytech |
- cpe:2.3:a:parity:frontier:*:*:*:*:*:*:*:* Versions 2021-09-30 to before 2021-10-13 Vulnerable ·paritytech
Remediation
- Fix · CNA frontier (paritytech) Fixed in 146bb48
Timeline
- 2026-10-02 Threatist record created from CVE-2021-41138
- 2026-10-03 Alias added: GHSA-vj62-g63v-f8mf
References
Patch 3
More paritytech Frontier vulnerabilities
- TI-2023-24151 Frontier opcode SUICIDE touches too many storage values on large contracts CVSS 3.1HIGH 7.5
- TI-2023-12975 Frontier's modexp precompile is slow for even modulus CVSS 3.1HIGH 7.5
- TI-2022-16433 Message length overflow in frontier CVSS 3.1HIGH 7.1
- TI-2022-13155 Discrepency in transfer value and actual value due to incorrect truncation in Frontier CVSS 3.1MEDIUM 5.3
- TI-2022-06061 Integer underflow in Frontier CVSS 3.1MEDIUM 6.5
- TI-2022-18619 Incorrect Calculation in Frontier leads to inflated Ethereum chain gas prices CVSS 3.1MEDIUM 5.3
Sources
- CVE-2021-41138 · CVE Program
- CVE-2021-41138 · NVD
- FIRST EPSS
- GHSA-vj62-g63v-f8mf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences