SB2020112447 - Buffer overflow in go-ethereum

Description

This security bulletin contains information about 1 vulnerability.

1) Buffer overflow (CVE-ID: CVE-2020-26241)

The vulnerability allows a remote attacker to cause a chain split where vulnerable nodes reject the canonical chain.

The vulnerability exists due to memory corruption in the dataCopy precompile when processing crafted contract execution involving RETURNDATACOPY. A remote attacker can deploy a specially crafted contract to cause a chain split where vulnerable nodes reject the canonical chain.

The issue arises because the precompile performs a shallow copy on invocation, which can cause divergent EVM results compared to consensus-compliant nodes.

Remediation

Install update from vendor's website.

References

• https://github.com/ethereum/go-ethereum/security/advisories/GHSA-69v6-xc2j-r2jf
• https://blog.ethereum.org/2020/11/12/geth_security_release/