id: GO-2022-0254
modules:
    - module: github.com/ethereum/go-ethereum
      versions:
        - fixed: 1.10.8
      vulnerable_at: 1.10.7
      packages:
        - package: github.com/ethereum/go-ethereum/core/vm
          symbols:
            - opCall
            - opCallCode
            - opDelegateCall
            - opStaticCall
            - EVMInterpreter.Run
          derived_symbols:
            - EVM.Call
            - EVM.CallCode
            - EVM.Create
            - EVM.Create2
            - EVM.DelegateCall
            - EVM.StaticCall
summary: Consensus flaw during block processing in github.com/ethereum/go-ethereum
description: |-
    A vulnerability in the Geth EVM can cause a node to reject the canonical chain.

    A memory-corruption bug within the EVM can cause a consensus error, where
    vulnerable nodes obtain a different stateRoot when processing a maliciously
    crafted transaction. This, in turn, would lead to the chain being split in two
    forks.
published: 2022-07-15T23:07:56Z
cves:
    - CVE-2021-39137
ghsas:
    - GHSA-9856-9gg9-qcmq
references:
    - fix: https://github.com/ethereum/go-ethereum/pull/23381/commits/4d4879cafd1b3c906fc184a8c4a357137465128f