GHSA-ppjg-v974-84cm

Suggest an improvement
Source
https://github.com/advisories/GHSA-ppjg-v974-84cm
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-ppjg-v974-84cm/GHSA-ppjg-v974-84cm.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-ppjg-v974-84cm
Aliases
Published
2023-09-06T19:49:46Z
Modified
2023-11-08T17:39:39Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Go-Ethereum vulnerable to denial of service via malicious p2p message
Details

Impact

A vulnerable node, can be made to consume unbounded amounts of memory when handling specially crafted p2p messages sent from an attacker node.

Details

The p2p handler spawned a new goroutine to respond to ping requests. By flooding a node with ping requests, an unbounded number of goroutines can be created, leading to resource exhaustion and potentially crash due to OOM.

Patches

The fix is included in geth version 1.12.1-stable, i.e, 1.12.2-unstable and onwards.

Fixed by https://github.com/ethereum/go-ethereum/pull/27887

Workarounds

No known workarounds.

Credits

This bug was reported by Patrick McHardy and reported via bounty@ethereum.org.

References

References

Affected packages

Go / github.com/ethereum/go-ethereum

Package

Name
github.com/ethereum/go-ethereum
View open source insights on deps.dev
Purl
pkg:golang/github.com/ethereum/go-ethereum

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.12.1-stable