TI-2022-06061 Aliases CVE-2022-21685 GHSA-cjg2-2fjg-fph4

Integer underflow in Frontier

LOW 32CWE-191Published 2022-01-14 · Updated 2025-04-23

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-191 and the CVSS impact.

Summary

Frontier is Substrate's Ethereum compatibility layer. Prior to commit number `8a93fdc6c9f4eb1d2f2a11b7ff1d12d70bf5a664`, a bug in Frontier's MODEXP precompile implementation can cause an integer underflow in certain conditions. This will cause a node crash for debug builds. For release builds (and production WebAssembly binaries), the impact is limited as it can only cause a normal EVM out-of-gas. Users who do not use MODEXP precompile in their runtime are not impacted. A patch is available in pull request #549.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01375 72nd percentileScored 2026-11-07

Fix Fixed frontier (paritytech): 8a93fdc

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
paritytech	frontier	before 8a93fdc	8a93fdc	Patch available	CNA
—	pallet-evm-precompile-modexp (crates.io)	up to 1.0.0	—	No fix listed	GHSA-cjg2-2fjg-fph4

frontier Vendorparitytech Affected before 8a93fdc Fixed in 8a93fdc Patch available CNA
pallet-evm-precompile-modexp (crates.io) Vendor— Affected up to 1.0.0 Fixed in — No fix listed GHSA-cjg2-2fjg-fph4

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:parity:frontier::::::::	up to 2022-01-13	Vulnerable	paritytech

cpe:2.3:a:parity:frontier:*:*:*:*:*:*:*:* Versions up to 2022-01-13 Vulnerable ·paritytech

Remediation

Fix · CNA frontier (paritytech) Fixed in 8a93fdc

Timeline

2026-10-02 Threatist record created from CVE-2022-21685
2026-10-03 Alias added: GHSA-cjg2-2fjg-fph4

References

Patch 3

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2022-21685

Other 1

https://github.com/paritytech/frontier

TI-2023-24151 Frontier opcode SUICIDE touches too many storage values on large contracts CVSS 3.1HIGH 7.5
TI-2023-12975 Frontier's modexp precompile is slow for even modulus CVSS 3.1HIGH 7.5
TI-2022-16433 Message length overflow in frontier CVSS 3.1HIGH 7.1
TI-2022-13155 Discrepency in transfer value and actual value due to incorrect truncation in Frontier CVSS 3.1MEDIUM 5.3
TI-2022-18619 Incorrect Calculation in Frontier leads to inflated Ethereum chain gas prices CVSS 3.1MEDIUM 5.3
TI-2021-17977 Validity check for signed Frontier-specific extrinsic not called in block execution CVSS 3.1MEDIUM 5.3

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences