What is CVE-2021-25837?

CVE-2021-25837 is a high-severity vulnerability in Chainsafe Ethermint. CVSS score: 7.5/10. Published 2021-02-08.

How severe is CVE-2021-25837?

High severity. CVSS v3 base score is 7.5 out of 10.

Is CVE-2021-25837 known to be exploited?

13 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Chainsafe Ethermint

CVE-2021-25837

Cosmos Network Ethermint <= v0.4.0 is affected by cache lifecycle inconsistency in the EVM module. Due to the inconsistency between the Storage caching cycle and the Tx processing cycle, Storage changes caused by a failed transaction are improperly reserved in memory. Although the bad storage cache data will be discarded at EndBlock, it is still valid in the current block, which enables many possible attacks such as an "arbitrary mint token".

EPSS: 0.015 (72.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

Affected products

Chainsafe Ethermint
N/a — versions n/a

Public proof-of-concept exploits

References

cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2021-25837?: CVE-2021-25837 is a high-severity vulnerability in Chainsafe Ethermint. CVSS score: 7.5/10. Published 2021-02-08.
How severe is CVE-2021-25837?: High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2021-25837 known to be exploited?: 13 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.