GitHub Advisoryadvisory · Go

GHSA-wjxw-gh3m-7pm5 DoS via malicious p2p message in Go Ethereum

MEDIUM Published 2022-05-24 Modified 2022-06-07 Official page ↗
Aliases
CVE-2022-29177
Ecosystem
Go
Packages
github.com/ethereum/go-ethereum
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2022-05-24

Affected packages

• Go github.com/ethereum/go-ethereum: < 1.10.17 → fixed in 1.10.17

Description

Impact A vulnerable node, if configured to use high verbosity logging, can be made to crash when handling specially crafted p2p messages sent from an attacker node. Patches The following PR addresses the problem: https://github.com/ethereum/go-ethereum/pull/24507 Workarounds Aside from applying the PR linked above, setting loglevel to default level (`INFO`) makes the node not vulnerable to this attack. Credits This bug was reported by `nrv` via [email protected], who has gracefully requested that the bounty rewards be donated to Médecins sans frontières. For more information If you have any questions or comments about this advisory: • Open an issue in go-ethereum

Related

Alias · CVE (1)

  • CVE-2022-29177 Go Ethereum is the official Golang implementation of the Ethereum protocol. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References