PT-2020-16370 · Ethereum · Geth

Holiman · Published 2020-11-25 · Updated 2021-07-28 · CVE-2020-26242

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Geth versions prior to 1.9.18

Description The issue is a Denial-of-service (crash) during block processing, which can be exploited through the MULMOD operation by specifying a modulo of 0: mulmod(a,b,0), causing a panic in the underlying library. This occurs due to improper bounds checking in certain mathematical operations, potentially allowing for a denial of service attack if untrusted user inputs are processed. The vulnerability can cause all vulnerable nodes to drop off the network.

Recommendations For versions prior to 1.9.18, upgrade to v1.9.18 or higher to resolve the issue. As a temporary workaround, consider restricting the use of the MULMOD operation with a modulo of 0 to minimize the risk of exploitation.

Fix

Out of bounds Read

Integer Underflow

Resource Exhaustion

Weakness Enumeration

CWE-125

CWE-191

CWE-400

Related Identifiers

CVE-2020-26242

GHSA-JM5C-RV3W-W83M

GO-2021-0103

Affected Products

Geth

References · 13

• https://osv.dev/vulnerability/CVE-2020-26242 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2021-0103 · Vendor Advisory
• https://blog.ethereum.org/2020/11/12/geth_security_release · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26242 · Security Note
• https://osv.dev/vulnerability/GHSA-jm5c-rv3w-w83m · Vendor Advisory
• https://github.com/ethereum/go-ethereum/security/advisories/GHSA-jm5c-rv3w-w83m · Note
• https://github.com/ethereum/go-ethereum · Note
• https://github.com/ethereum/go-ethereum/commit/7163a6664ee664df81b9028ab3ba13b9d65a7196 · Note
• https://github.com/holiman/uint256/pull/80 · Note
• https://github.com/holiman/uint256/commit/6785da6e3eea403260a5760029e722aa4ff1716d · Note
• https://pkg.go.dev/vuln/GO-2021-0103 · Note
• https://t.me/cibsecurity/16839 · Telegram Post
• https://t.me/cvenotify/6171 · Telegram Post