CVE-2021-41138 json
Validity check for signed Frontier-specific extrinsic not called in block execution
published 2021-10-13 5 y ago modified 2026-07-08 4 mo ago also GHSA-vj62-g63v-f8mf , EUVD-2021-2260
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.4%
- EPSS 1.4% chance of exploitation in 30 days, percentile 72%
- public exploits
- 0
- none known
Summary
Frontier is Substrate's Ethereum compatibility layer. In the newly introduced signed Frontier-specific extrinsic for `pallet-ethereum`, a large part of transaction validation logic was only called in transaction pool validation, but not in block execution. Malicious validators can take advantage of this to put invalid transactions into a block. The attack is limited in that the signature is always validated, and the majority of the validation is done again in the subsequent `pallet-evm` execution logic. However, do note that a chain ID replay attack was possible. In addition, spamming attacks are of main concerns, while they are limited by Substrate block size limits and other factors. The issue is patched in commit `146bb48849e5393004be5c88beefe76fdf009aba`.
Patch / fix
- parity frontier 2021-10-13
- github.com/paritytech/frontier@146bb48 commit
- github.com/paritytech/frontier#497 pull request
- github.com/paritytech/frontier#495 pull request
- github.com/paritytech/frontier/security/advisories/GHSA-vj62-g63v-f8mf advisory
Exploit prediction
1.38% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | pallet-ethereum | <=3.0.0 |
no fix listed |
Affected products
- paritytech frontier
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
github.com
/paritytech/frontier/pull/497
web, patch, third-party-advisory
-
github.com
/paritytech/frontier/commit/146bb48849e5393004be5c88beefe76fdf009aba
web, patch, third-party-advisory
-
github.com
/paritytech/frontier/security/advisories/GHSA-vj62-g63v-f8mf
web, patch, third-party-advisory
-
github.com
/paritytech/frontier/pull/495
web
-
nvd.nist.gov
/vuln/detail/CVE-2021-41138
advisory
-
github.com
/polkadot-evm/frontier
package
Sources
- CVE List CVE-2021-41138
- GitHub Advisory GHSA-vj62-g63v-f8mf
- NVD CVE-2021-41138
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.