PT-2022-16026 · Go-Libp2P · Go-Libp2P

P-Shahi · Published 2022-12-07 · Updated 2023-07-14 · CVE-2022-23492

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions go-libp2p versions 0.18.0 and older

Description The issue concerns targeted resource exhaustion attacks that affect libp2p's connection, stream, peer, and memory management. An attacker can cause the allocation of large amounts of memory, ultimately leading to the process getting killed by the host's operating system. While a connection manager is part of go-libp2p to keep connections within manageable limits, it was designed to handle regular peer churn, not targeted resource exhaustion attacks.

Recommendations To resolve the issue, upgrade go-libp2p to version 0.18.1 or newer. For versions prior to 0.18.1, consider the following:

• Update your go-libp2p dependency to go-libp2p v0.18.1 or greater.
• Determine appropriate limits for your application, as go-libp2p sets up a resource manager with default limits if none are provided.
• Configure your node to be attack resilient by setting up automatic blocking with fail2ban using canonical libp2p log lines.
• Consider updating to v0.21.0 or newer for additional functionality that helps in production environments, such as better metrics around resource usage and default autoscaling limits. For users unable to upgrade, consult the denial of service (dos) mitigation page for more information on incorporating mitigation strategies, monitoring your application, and responding to attacks.

Exploit

Fix

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2022-23492

GHSA-J7QP-MFXF-8XJW

GO-2022-1148

Affected Products

Go-Libp2P

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23492.json · Exploit
• https://github.com/libp2p/go-libp2p/commit/15d7dfbf54264ead8e6f49ca658d79c90635e2de · Patch
• https://docs.libp2p.io/reference/dos-mitigation · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23492 · Security Note
• https://osv.dev/vulnerability/GO-2022-1148 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j7qp-mfxf-8xjw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23492 · Vendor Advisory
• https://github.com/libp2p/go-libp2p · Note
• https://github.com/libp2p/go-libp2p/security/advisories/GHSA-j7qp-mfxf-8xjw · Note
• https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-jvgw-gccv-q5p8 · Note
• https://github.com/libp2p/js-libp2p/security/advisories/GHSA-f44q-634c-jvwv · Note
• https://pkg.go.dev/vuln/GO-2022-1148 · Note
• https://t.me/cibsecurity/54148 · Telegram Post
• https://t.me/cvenotify/39404 · Telegram Post