GitHub Advisoryadvisory · crates.io

GHSA-29c2-65rj-h343 Nervos CKB Permit load cell data from memory

MEDIUM Published 2024-02-03 Modified 2024-02-03 Official page ↗
Ecosystem
crates.io
Packages
ckb
Severity
Moderate
Reviewed
2024-02-03

Affected packages

• crates.io ckb: >= 0.39.0-rc1, < 0.39.0 → fixed in 0.39.0 • crates.io ckb: >= 0.35.0-rc1, < 0.35.2 → fixed in 0.35.2 • crates.io ckb: >= 0.36.0-rc1, < 0.36.1 → fixed in 0.36.1 • crates.io ckb: >= 0.37.0-rc1, < 0.37.1 → fixed in 0.37.1 • crates.io ckb: >= 0.38.0-rc1, < 0.38.2 → fixed in 0.38.2

Description

Impact The faulty nodes will reject transactions which calls `load_cell_data` syscall but the input cell is still in the mempool. They also ban other nodes and cause the network separation. Patches 0.35.2, 0.36.1, 0.37.1, 0.38.2

References