PT-2023-24276 · Unknown+1 · Bitcoin Core+1

Kev · Published 2023-05-22 · Updated 2024-11-14 · CVE-2023-33297

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Bitcoin Core versions prior to 24.1

Description The issue allows attackers to cause a denial of service, specifically CPU consumption, because draining the inventory-to-send queue is inefficient. This has been exploited in the wild in May 2023.

Recommendations For Bitcoin Core versions prior to 24.1, update to version 24.1 or later to resolve the issue. As a temporary workaround, consider enabling debug mode to mitigate the risk of CPU consumption attacks. Restrict access to the inventory-to-send queue to minimize the risk of exploitation.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

ALT-PU-2023-1884

ALT-PU-2024-15200

CVE-2023-33297

Affected Products

Alt Linux

Bitcoin Core

References · 35

• https://github.com/bitcoin/bitcoin/pull/27610 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-33297 · Security Note
• https://osv.dev/vulnerability/CVE-2023-33297 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-33297 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-50428 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H3CQY277NWXY3RFCZCJ4VKT2P3ROACEJ · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37192 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-50428 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2EI7SAP4QP2AJYK2JVEOO4GJ6DOBSM5 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-34149 · Security Note
• https://errata.altlinux.org/ALT-PU-2024-15200 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2023-1884 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35202 · Security Note
• https://github.com/bitcoin/bitcoin/issues/27586 · Note
• https://github.com/bitcoin/bitcoin/blob/master/doc/release-notes/release-notes-24.1.md · Note