GitHub Advisoryadvisory · Go
GHSA-v592-xf75-856p Erroneous Proof of Work calculation in geth
MEDIUM
Official page ↗
- Aliases
- CVE-2020-26240
- Ecosystem
- Go
- Packages
- github.com/ethereum/go-ethereum
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
- Weaknesses
- CWE-682
- Reviewed
- 2021-05-21
Affected packages
• Go github.com/ethereum/go-ethereum: < 1.9.24 → fixed in 1.9.24
Description
Impact
An ethash mining DAG generation flaw in Geth could cause miners to erroneously calculate PoW in an upcoming epoch (estimated early January, 2021). This happened on the ETC chain on 2020-11-06. This issue is relevant only for miners, non-mining nodes are unaffected.
Patches
This issue is also fixed as of 1.9.24. Thanks to @slavikus for bringing the issue to our attention and writing the fix.
Workarounds
This PR implements a patch: https://github.com/ethereum/go-ethereum/pull/21793
References
https://blog.ethereum.org/2020/11/12/geth_security_release/
For more information
If you have any questions or comments about this advisory:
• Open an issue in go-ethereum
• Email us at [email protected]
Related
Alias · CVE (1)
- CVE-2020-26240 Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. vulnerability
Weakness · CWE (1)
- CWE-682 Incorrect Calculation weakness
References
- https://github.com/ethereum/go-ethereum/security/advisories/GHSA-v592-xf75-856p web
- https://nvd.nist.gov/vuln/detail/CVE-2020-26240 advisory
- https://github.com/ethereum/go-ethereum/pull/21793 web
- https://github.com/ethereum/go-ethereum/commit/d990df909d7839640143344e79356754384dcdd0 web
- https://blog.ethereum.org/2020/11/12/geth_security_release web
- https://github.com/ethereum/go-ethereum package