PT-2020-16538 · Lightning Network · Lnd

Antoine Riard · Published 2020-10-21 · Updated 2024-01-19 · CVE-2020-26896

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions LND (Lightning Network Daemon) versions prior to 0.11.0-beta

Description The issue concerns a problem in the invoice database where LND failed to verify the settlement of an outgoing off-chain HTLC before releasing the preimage while claiming a received HTLC output on-chain. This could lead to a hash-and-amount collision with an invoice, causing the preimage for an expected payment to be released instead. A malicious peer could intercept an HTLC, probe the preimage through a colluding relayed HTLC, and steal the intercepted HTLC, resulting in a loss of funds and weakened receiver privacy.

Recommendations For versions prior to 0.11.0-beta, update to version 0.11.0-beta or later to resolve the issue.

Fix

Weakness Enumeration

CWE-354

Related Identifiers

CVE-2020-26896

Affected Products

Lnd

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2020-26896 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26896 · Vendor Advisory
• https://lists.linuxfoundation.org/pipermail/lightning-dev/2020-October/002857.html · Patch
• https://twitter.com/reibiz/status/1748333918573474133 · Twitter Post
• https://gist.github.com/ariard/6bdeb995565d1cc292753e1ee4ae402d · Note
• https://lists.linuxfoundation.org/pipermail/lightning-dev/2020-October/002855.html · Note
• https://twitter.com/dpuellARK___/status/1747923866163241039 · Twitter Post
• https://twitter.com/reibiz/status/1748333968473121127 · Twitter Post