GHSA-rqmg-hrg4-fm69MediumCVSS 5.9

Go Ethereum allows attackers to use manipulation of time-difference values to achieve replacement of main-chain blocks

Published
August 6, 2022
Last Modified
January 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-37450 →

📋 Description

Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making (RUM), as exploited in the wild in 2020 through 2022.

🎯 Affected products1

  • go/github.com/ethereum/go-ethereum:<= 1.10.21

🔗 References (6)