CVE-2022-39354

    Dashboard / Vulnerabilities / CVE-2022-39354

    CVE-2022-39354

    Published: 25 Oct 2022Last Modified: 29 Jul 2025

    Summary:

    Details: SputnikVM, also called evm, is a Rust implementation of Ethereum Virtual Machine. A custom stateful precompile can use the `is_static` parameter to determine if the call is executed in a static context (via `STATICCALL`), and thus decide if stateful operations should be done. Prior to version 0.36.0, the passed `is_static` parameter was incorrect -- it was only set to `true` if the call came from a direct `STATICCALL` opcode. However, once a static call context is entered, it should stay static. The issue only impacts custom precompiles that actually uses `is_static`. For those affected, the issue can lead to possible incorrect state transitions. Version 0.36.0 contains a patch. There are no known workarounds.

    References: https://github.com/rust-blockchain/evm/pull/133, https://github.com/rust-blockchain/evm/security/advisories/GHSA-hhc4-47rh-cr34

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -8c05883c2d7052972fb8d8cb4fa6b132105ce53b

    Affected versions

    evm-core-v0.26.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-39354 | CVE-DB