CVE-2024-21629 json
Erroneous handling of `record_external_operation` error return
published 2024-01-02 2 y ago modified 2026-09-10 1 mo ago also GHSA-27wg-99g8-2v4v , EUVD-2024-0220
- cvss
- 5.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 47%
- public exploits
- 0
- none known
Summary
Rust EVM is an Ethereum Virtual Machine interpreter. In `rust-evm`, a feature called `record_external_operation` was introduced, allowing library users to record custom gas changes. This feature can have some bogus interactions with the call stack. In particular, during finalization of a `CREATE` or `CREATE2`, in the case that the substack execution happens successfully, `rust-evm` will first commit the substate, and then call `record_external_operation(Write(out_code.len()))`. If `record_external_operation` later fails, this error is returned to the parent call stack, instead of `Succeeded`. Yet, the substate commitment already happened. This causes smart contracts able to commit state changes, when the parent caller contract receives zero address (which usually indicates that the execution has failed). This issue only impacts library users with custom `record_external_operation` that returns errors. The issue is patched in release 0.41.1. No known workarounds are available.
Patch / fix
- crates.io evm 0.41.1
- evm_project evm 0.41.1
- github.com/rust-ethereum/evm@d8991ec commit
- github.com/rust-ethereum/evm#264 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.58% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| GitHub | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | evm | <0.41.1 |
0.41.1 |
Affected products
- rust-ethereum evm
Classification
- Weakness
-
- CWE-703 Improper Check or Handling of Exceptional Conditions
References
-
github.com
/rust-ethereum/evm/pull/264
web, patch
-
github.com
/rust-ethereum/evm/commit/d8991ec727ad0fb64fe9957a3cd307387a6701e4
web, patch
-
github.com
/rust-ethereum/evm/security/advisories/GHSA-27wg-99g8-2v4v
web, vendor-advisory
-
github.com
/rust-ethereum/evm/blob/release-v041/src/executor/stack/executor.rs#L1012C25-L1012C69
web, product
-
nvd.nist.gov
/vuln/detail/CVE-2024-21629
advisory
-
github.com
/rust-ethereum/evm
package
Sources
- CVE List CVE-2024-21629
- GitHub Advisory GHSA-27wg-99g8-2v4v
- NVD CVE-2024-21629
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.