Lucene search

GitHub_MCVELIST:CVE-2024-38533

HistoryJun 28, 2024 - 9:18 p.m.

CVE-2024-38533 ZKsync Era invalid stack addressing conversion

2024-06-2821:18:30

CWE-787

GitHub_M

www.cve.org

zksync ethereum layer 2 rollup zero-knowledge proof stack addressing conversion patched

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS

Percentile

9.1%

JSON

ZKsync Era is a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. There is possible invalid stack access due to the addresses used to access the stack not properly being converted to cells. This issue has been patched in version 1.5.0.

CNA Affected

[
  {
    "vendor": "matter-labs",
    "product": "era-compiler-vyper",
    "versions": [
      {
        "version": "< 1.5.0",
        "status": "affected"
      }
    ]
  }
]

References

github.com/matter-labs/era-compiler-vyper/security/advisories/GHSA-q7pg-6jh9-87gv

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS

Percentile

9.1%

JSON

Related for CVELIST:CVE-2024-38533