PT-2017-18795 · Bitcoin · Bitcoind

Cameron Garnham · Published 2017-05-24 · Updated 2025-05-06 · CVE-2017-9230

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bitcoin (affected versions not specified)

Description The Bitcoin Proof-of-Work algorithm has an issue related to 80-byte block headers with varying initial 64-byte chunks followed by the same 16-byte chunk, and multiple candidate root values ending with the same 4 bytes. This involves calculations with sqrt numbers, violating two security assumptions: the choice of input outside of the dedicated nonce area should not change the difficulty to evaluate the Proof-of-Work function, and every Proof-of-Work function execution should be independent. Some individuals consider this methodology a benign mining optimization rather than a vulnerability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-338

Related Identifiers

CVE-2017-9230

Affected Products

Bitcoind

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2017-9230 · Security Note
• https://osv.dev/vulnerability/CVE-2017-9230 · Vendor Advisory
• https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2017-May/014352.html · Note
• https://t.me/cvenotify/89248 · Telegram Post
• http://mit.edu/~jlrubin//public/pdfs/Asicboost.pdf · Note
• https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2017-May/014349.html · Note
• https://t.me/cvenotify/81982 · Telegram Post
• https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2017-May/014351.html · Note
• https://twitter.com/collectarmind/status/1919593475638460616 · Twitter Post
• https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2017-April/013996.html · Note
• http://securityfocus.com/bid/98657 · Note
• https://arxiv.org/ftp/arxiv/papers/1604/1604.00575.pdf · Note