Headline
GHSA-wjxw-gh3m-7pm5: DoS via malicious p2p message
Impact
A vulnerable node, if configured to use high verbosity logging, can be made to crash when handling specially crafted p2p messages sent from an attacker node.
Patches
The following PR addresses the problem: https://github.com/ethereum/go-ethereum/pull/24507
Workarounds
Aside from applying the PR linked above, setting loglevel to default level (INFO) makes the node not vulnerable to this attack.
Credits
This bug was reported by nrv via [email protected], who has gracefully requested that the bounty rewards be donated to Médecins sans frontières.
For more information
If you have any questions or comments about this advisory:
- Open an issue in go-ethereum
Impact
A vulnerable node, if configured to use high verbosity logging, can be made to crash when handling specially crafted p2p messages sent from an attacker node.
Patches
The following PR addresses the problem: ethereum/go-ethereum#24507
Workarounds
Aside from applying the PR linked above, setting loglevel to default level (INFO) makes the node not vulnerable to this attack.
Credits
This bug was reported by nrv via [email protected], who has gracefully requested that the bounty rewards be donated to Médecins sans frontières.
For more information
If you have any questions or comments about this advisory:
- Open an issue in go-ethereum
References
- GHSA-wjxw-gh3m-7pm5
- https://nvd.nist.gov/vuln/detail/CVE-2022-29177
- ethereum/go-ethereum#24507
Related news
Go Ethereum is the official Golang implementation of the Ethereum protocol. Prior to version 1.10.17, a vulnerable node, if configured to use high verbosity logging, can be made to crash when handling specially crafted p2p messages sent from an attacker node. Version 1.10.17 contains a patch that addresses the problem. As a workaround, setting loglevel to default level (`INFO`) makes the node not vulnerable to this attack.