An exploitable information leak/denial of service vulnerability exists in the libevm (Ethereum Virtual Machine) `create2` opcode handler of CPP-Ethereum. A specially crafted smart contract code can cause an out-of-bounds read leading to memory disclosure or denial of service. An attacker can create/send malicious a smart contract to trigger this vulnerability.
References
Link | Resource |
---|---|
http://www.securityfocus.com/bid/102475 | Third Party Advisory VDB Entry |
https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0503 | Third Party Advisory |
Configurations
History
30 Jan 2023, 19:31
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : 6.4
v3 : 8.2 |
Information
Published : 2018-01-19 23:29
Updated : 2023-12-10 12:30
NVD link : CVE-2017-14457
Mitre link : CVE-2017-14457
CVE.ORG link : CVE-2017-14457
JSON object : View
Products Affected
ethereum
- ethereum_virtual_machine
CWE
CWE-125
Out-of-bounds Read