GHSA-hc82-w9v8-83pr

Source

https://github.com/advisories/GHSA-hc82-w9v8-83pr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-hc82-w9v8-83pr/GHSA-hc82-w9v8-83pr.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-hc82-w9v8-83pr

Aliases

CVE-2022-39389

Published

2022-11-18T18:50:01Z

Modified

2023-11-08T04:10:20.776131Z

Severity

8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H CVSS Calculator

Summary

Witness Block Parsing DoS Vulnerability

Details

Impact

All lnd nodes before version v0.15.4 are vulnerable to a block parsing bug that can cause a node to enter a degraded state once encountered. In this degraded state, nodes can continue to make payments and forward HTLCs, and close out channels. Opening channels is prohibited, and also on chain transaction events will be undetected.

This can cause loss of funds if a CSV expiry is researched during a breach attempt or a CLTV delta expires forgetting the funds in the HTLC.

Patches

A patch is available starting with lnd v0.15.4.

Workarounds

Nodes can use the lncli updatechanpolicy RPC call to increase their CLTV value to a very high amount or increase their fee policies. This will prevent nodes from routing through your node, meaning that no pending HTLCs can be present.

References

https://github.com/lightningnetwork/lnd/issues/7096

https://github.com/lightningnetwork/lnd/releases/tag/v0.15.4-beta

Database specific

{
    "cwe_ids": [
        "CWE-20"
    ],
    "github_reviewed_at": "2022-11-18T18:50:01Z",
    "nvd_published_at": "2022-11-17T22:15:00Z",
    "severity": "HIGH",
    "github_reviewed": true
}

References

Affected packages

Go / github.com/lightningnetwork/lnd

Package

Name: github.com/lightningnetwork/lnd; View open source insights on deps.dev
Purl: pkg:golang/github.com/lightningnetwork/lnd

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.15.4-beta

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-hc82-w9v8-83pr/GHSA-hc82-w9v8-83pr.json"