GitHub Advisoryadvisory · Go

GHSA-ppjg-v974-84cm Go-Ethereum vulnerable to denial of service via malicious p2p message

HIGH Published 2023-09-06 Modified 2023-11-08 Official page ↗
Aliases
CVE-2023-40591
Ecosystem
Go
Packages
github.com/ethereum/go-ethereum
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2023-09-06

Affected packages

• Go github.com/ethereum/go-ethereum: < 1.12.1-stable → fixed in 1.12.1-stable

Description

Impact A vulnerable node, can be made to consume unbounded amounts of memory when handling specially crafted p2p messages sent from an attacker node. Details The p2p handler spawned a new goroutine to respond to `ping` requests. By flooding a node with ping requests, an unbounded number of goroutines can be created, leading to resource exhaustion and potentially crash due to OOM. Patches The fix is included in geth version `1.12.1-stable`, i.e, `1.12.2-unstable` and onwards. Fixed by https://github.com/ethereum/go-ethereum/pull/27887 Workarounds No known workarounds. Credits This bug was reported by Patrick McHardy and reported via [email protected]. References

Related

Alias · CVE (1)

  • CVE-2023-40591 go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References