CVE-2022-29219 affects Lodestar, a TypeScript implementation of the Ethereum Consensus specification, prior to version 0.36.0. The vulnerability stems from incorrect handling of large uint64 values, represented as native JavaScript numbers, leading to rounding errors. This can cause Lodestar nodes to misinterpret valid or invalid AttesterSlashing or ProposerSlashing messages, resulting in a consensus split where Lodestar nodes fork from the main network. The vulnerability has a CVSS score of 7.5 (HIGH), indicating a network-based attack with low complexity and high integrity impact, but no confidentiality or availability impact. It can be exploited without user interaction or privileges. There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage regarding this vulnerability. A fix is available in Lodestar version 0.36.0, and a workaround involves using BigInt for specific Slot and Epoch values.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 0.36.0CPE matchmatch criteria | cpe:2.3:a:chainsafe:lodestar:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.