PT-2022-28072 · Gossipsub · Gossipsub

Published 2022-12-19 · Updated 2023-01-04 · CVE-2022-47547

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions GossipSub version 1.1

Description The issue allows a peer to maintain a positive score and remain in the network despite continuously misbehaving by not forwarding topic messages. This affects GossipSub 1.1 as used for Ethereum 2.0.

Recommendations For GossipSub version 1.1, consider implementing additional checks to ensure peers that do not forward topic messages are properly penalized and potentially pruned from the network. As a temporary workaround, consider restricting the ability of peers to maintain a positive score if they are not contributing to the network by forwarding messages. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

CVE-2022-47547

Affected Products

Gossipsub

References · 4

• 🔥 https://arxiv.org/pdf/2212.05197.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-47547 · Security Note
• https://osv.dev/vulnerability/CVE-2022-47547 · Vendor Advisory
• https://t.me/cvenotify/40139 · Telegram Post