Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-29511

CVE-2021-29511: Memory over-allocation in evm crate

6.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-29511
GHSA ID
GHSA-4jwq-572w-4388
EPSS Score
0.58421%
CWE
CWE-770
Published
1/30/2024
Updated
1/30/2024
KEV Status
No
Technology
TechnologyRust

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
evmrust<= 0.21.00.21.1
evm-corerust<= 0.21.00.21.1
evmrust= 0.22.00.22.1
evmrust= 0.23.00.23.1
evmrust= 0.24.00.24.1
evmrust= 0.25.00.25.1
evmrust= 0.26.00.26.1
evm-corerust= 0.22.00.22.1
evm-corerust= 0.23.00.23.1
evm-corerust= 0.24.00.24.1
evm-corerust= 0.25.00.25.1
evm-corerust= 0.26.00.26.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability description explicitly mentions memory over-allocation in evm_core::Memory::copy_large. The fix commit shows an added early return for empty values in this function, indicating the vulnerability stemmed from processing zero-length copies. The CWE-770 mapping confirms this is a resource allocation issue. The direct correlation between the vulnerability description, CWE mapping, and commit diff provides high confidence in this assessment.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t Prior to t** p*t**, w**n *x**utin* sp**i*i* *VM op*o**s r*l*t** to m*mory op*r*tions t**t us* `*vm_*or*::M*mory::*opy_l*r**`, t** *r*t* **n ov*r-*llo**t* m*mory w**n it is not n*****, m*kin* it possi*l* *or *n *tt**k*r to p*r*orm **ni*l-o*

Reasoning

T** vuln*r**ility **s*ription *xpli*itly m*ntions m*mory ov*r-*llo**tion in `*vm_*or*::M*mory::*opy_l*r**`. T** *ix *ommit s*ows *n ***** **rly r*turn *or *mpty v*lu*s in t*is *un*tion, in*i**tin* t** vuln*r**ility st*mm** *rom pro**ssin* z*ro-l*n*t*