{"id":"CVE-2022-37450","aliases":["ALPINE-CVE-2022-37450","EUVD-2022-6621","GHSA-rqmg-hrg4-fm69"],"status":"published","title":"Go Ethereum allows attackers to use manipulation of time-difference values to achieve replacement of main-chain blocks","description":"Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making (RUM), as exploited in the wild in 2020 through 2022.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01271,"percentile":0.7007,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2022-08-05T20:30:46Z","modified":"2026-11-03T07:30:30Z","fixes":[{"ecosystem":"Alpine:v3.16","package":"geth","fixed_in":["1.10.22-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"geth","fixed_in":["1.10.22-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"geth","fixed_in":["1.10.22-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"geth","fixed_in":["1.10.22-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"geth","fixed_in":["1.10.22-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"geth","fixed_in":["1.10.22-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"geth","fixed_in":["1.10.22-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"geth","fixed_in":["1.10.22-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"geth","fixed_in":["1.10.22-r0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/ethereum/go-ethereum","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.10.21"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"geth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.22-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"geth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.22-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"geth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.22-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"geth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.22-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"geth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.22-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"geth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.22-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"geth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.22-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"geth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.22-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"geth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.22-r0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/ethereum/go-ethereum","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"1.10.21"}]}]}],"products":[{"vendor":"ethereum","product":"go_ethereum"}],"references":[{"url":"https://github.com/ethereum/go-ethereum/blob/671094279e8d27f4b4c3c94bf8b636c26b473976/core/forkchoice.go#L91-L94","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://medium.com/%40aviv.yaish/uncle-maker-time-stamping-out-the-competition-in-ethereum-d27c1cb62fef","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://dx.doi.org/10.13140/RG.2.2.27813.99043","tags":["x_refsource_MISC","x_transferred","Broken Link","web"]},{"url":"https://news.ycombinator.com/item?id=32354896","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-37450","tags":["advisory"]},{"url":"https://medium.com/@aviv.yaish/uncle-maker-time-stamping-out-the-competition-in-ethereum-d27c1cb62fef","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rqmg-hrg4-fm69"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-37450","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/37xxx/CVE-2022-37450.json","tags":["advisory"]},{"url":"https://github.com/ethereum/go-ethereum","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-37450","description":"Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making (RUM), as exploited in the wild in 2020 through 2022.","status":"published","published":"2022-08-05T20:30:46Z","modified":"2024-08-03T10:29:20.985Z","updated_at":"2026-11-02T14:34:27.327929Z"}],"euvd":[{"id":"EUVD-2022-6621","description":"Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making (RUM), as exploited in the wild in 2020 through 2022.","status":"published","published":"2022-08-05T20:30:46Z","modified":"2024-08-03T10:29:20Z","updated_at":"2026-11-03T03:25:23.480504Z"}],"ghsa":[{"id":"GHSA-rqmg-hrg4-fm69","title":"Go Ethereum allows attackers to use manipulation of time-difference values to achieve replacement of main-chain blocks","description":"Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making (RUM), as exploited in the wild in 2020 through 2022.","status":"published","published":"2022-08-06T00:00:36Z","modified":"2023-01-27T05:05:29Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T14:36:21.8171Z"}],"nvd":[{"id":"CVE-2022-37450","description":"Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making (RUM), as exploited in the wild in 2020 through 2022.","status":"published","published":"2022-08-05T21:15:09.087Z","modified":"2026-06-17T04:55:06.793Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:07:24.39467Z"}],"osv":[{"id":"ALPINE-CVE-2022-37450","description":"Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making (RUM), as exploited in the wild in 2020 through 2022.","status":"published","published":"2022-08-05T21:15:09.087Z","modified":"2026-11-03T07:30:30.582432679Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"GHSA-rqmg-hrg4-fm69","title":"Go Ethereum allows attackers to use manipulation of time-difference values to achieve replacement of main-chain blocks","description":"Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making (RUM), as exploited in the wild in 2020 through 2022.","status":"published","published":"2022-08-06T00:00:36Z","modified":"2023-11-08T04:10:08.62443Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:46:56.281047Z"},{"id":"CVE-2022-37450","description":"Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making (RUM), as exploited in the wild in 2020 through 2022.","status":"published","published":"2022-08-05T20:30:46Z","modified":"2026-10-28T02:30:56.61473698Z","updated_at":"2026-11-02T15:44:26.53798Z"}]}}