Every CVE Search/ Get API key

CVE-2022-37450

Go Ethereum allows attackers to use manipulation of time-difference values to achieve replacement of main-chain blocks

5.9 MediumFix available

Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making (RUM), as exploited in the wild in 2020 through 2022.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

1.27%Up 0.3 points since Aug 6, 2022
90%50%10%1%

What each source reports

NVD Score used 5.9

Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making (RUM), as exploited in the wild in 2020 through 2022.

Record
CVE-2022-37450
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
CVE List No score

Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making (RUM), as exploited in the wild in 2020 through 2022.

Record
CVE-2022-37450
Updated
2026-11-02
EUVDEUVD-2022-6621 No score

Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making (RUM), as exploited in the wild in 2020 through 2022.

Record
EUVD-2022-6621
Updated
2026-11-03
GitHub AdvisoriesGHSA-rqmg-hrg4-fm69 5.9

Go Ethereum allows attackers to use manipulation of time-difference values to achieve replacement of main-chain blocks

Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making (RUM), as exploited in the wild in 2020 through 2022.

Record
GHSA-rqmg-hrg4-fm69
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVALPINE-CVE-2022-37450 5.9

Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making (RUM), as exploited in the wild in 2020 through 2022.

Record
ALPINE-CVE-2022-37450
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-03
OSVGHSA-rqmg-hrg4-fm69 5.9

Go Ethereum allows attackers to use manipulation of time-difference values to achieve replacement of main-chain blocks

Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making (RUM), as exploited in the wild in 2020 through 2022.

Record
GHSA-rqmg-hrg4-fm69
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSV No score

Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making (RUM), as exploited in the wild in 2020 through 2022.

Record
CVE-2022-37450
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/ethereum/go-ethereum
Go
 through 1.10.21 None known
geth
Alpine:v3.16
 before 1.10.22-r0
1.10.22-r0
geth
Alpine:v3.17
 before 1.10.22-r0
1.10.22-r0
geth
Alpine:v3.18
 before 1.10.22-r0
1.10.22-r0
geth
Alpine:v3.19
 before 1.10.22-r0
1.10.22-r0
geth
Alpine:v3.20
 before 1.10.22-r0
1.10.22-r0
geth
Alpine:v3.21
 before 1.10.22-r0
1.10.22-r0
geth
Alpine:v3.22
 before 1.10.22-r0
1.10.22-r0
geth
Alpine:v3.23
 before 1.10.22-r0
1.10.22-r0
geth
Alpine:v3.24
 before 1.10.22-r0
1.10.22-r0

History

History
RecordedChangedSources
affected, aliases, facts, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-37450 is a medium vulnerability (CVSS 5.9) in Ethereum Go Ethereum, published August 5, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.27%, the 70th percentile. Fixed in geth 1.10.22-r0.

References

Show 4 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open