CVE-2024-21629

Rust EVM is an Ethereum Virtual Machine interpreter. In `rust-evm`, a feature called `record_external_operation` was introduced, allowing library users to record custom gas changes. This feature can have some bogus interactions with the call stack. In particular, during finalization of a `CREATE` or `CREATE2`, in the case that the substack execution happens successfully, `rust-evm` will first commit the substate, and then call `record_external_operation(Write(out_code.len()))`. If `record_external_operation` later fails, this error is returned to the parent call stack, instead of `Succeeded`. Yet, the substate commitment already happened. This causes smart contracts able to commit state changes, when the parent caller contract receives zero address (which usually indicates that the execution has failed). This issue only impacts library users with custom `record_external_operation` that returns errors. The issue is patched in release 0.41.1. No known workarounds are available.

• CWE-703

• https://github.com/rust-ethereum/evm/blob/release-v041/src/executor/stack/executor.rs#L1012C25-L1012C69Product
• https://github.com/rust-ethereum/evm/commit/d8991ec727ad0fb64fe9957a3cd307387a6701e4Patch
• https://github.com/rust-ethereum/evm/pull/264Patch
• https://github.com/rust-ethereum/evm/security/advisories/GHSA-27wg-99g8-2v4vVendor Advisory
• https://github.com/rust-ethereum/evm/blob/release-v041/src/executor/stack/executor.rs#L1012C25-L1012C69Product
• https://github.com/rust-ethereum/evm/commit/d8991ec727ad0fb64fe9957a3cd307387a6701e4Patch
• https://github.com/rust-ethereum/evm/pull/264Patch
• https://github.com/rust-ethereum/evm/security/advisories/GHSA-27wg-99g8-2v4vVendor Advisory

Published

Jan 2, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-21623OTCLient is an alternative tibia client for otserv. Prior to…9.8
• CVE-2024-21624nonebot2 is a cross-platform Python asynchronous chatbot fra…6.5
• CVE-2024-21625SideQuest is a place to get virtual reality applications for…8.8
• CVE-2024-21626runc is a CLI tool for spawning and running containers on Li…8.6
• CVE-2024-21627PrestaShop is an open-source e-commerce platform. Prior to v…6.1
• CVE-2024-21628PrestaShop is an open-source e-commerce platform. Prior to v…6.1
• CVE-2024-2163The Ninja Beaver Add-ons for Beaver Builder plugin for WordP…6.4
• CVE-2024-21630Zulip is an open-source team collaboration tool. A vulnerabi…4.3
• CVE-2024-21631Vapor is an HTTP web framework for Swift. Prior to version 4…6.5
• CVE-2024-21632omniauth-microsoft_graph provides an Omniauth strategy for t…9.8
• CVE-2024-21633Apktool is a tool for reverse engineering Android APK files.…7.8
• CVE-2024-21634Amazon Ion is a Java implementation of the Ion data notation…7.5