PT-2023-24605 · Multiversx · Mx-Chain-Go

Iulianpascalau · Published 2023-05-31 · Updated 2024-08-20 · CVE-2023-33964

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions mx-chain-go versions prior to 1.4.16

Description The metachain cannot process a cross-shard miniblock. An invalid transaction with the wrong username on metachain is not treated correctly on the metachain transaction processor, which is a processing issue that could have occurred on the MultiversX chain. If such an error occurred, the metachain would have stopped notarizing blocks from the shard chains. The resuming of notarization is possible only after applying a patched binary version. A patch introduces processIfTxErrorCrossShard for the metachain transaction processor.

Recommendations For versions prior to 1.4.16, update to version 1.4.16 or later, which includes the patch introducing processIfTxErrorCrossShard for the metachain transaction processor. As a temporary workaround, consider disabling the metachain transaction processor until a patched binary version is applied.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2023-33964

GHSA-7XPV-4PM9-XCH2

GO-2023-1806

Affected Products

Mx-Chain-Go

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33964.json · Exploit
• https://github.com/multiversx/mx-chain-go/commit/97295471465f4b5f79e51b32f8b7111f8d921606 · Patch
• https://github.com/multiversx/mx-chain-go/security/advisories/GHSA-7xpv-4pm9-xch2 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1806 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7xpv-4pm9-xch2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-33964 · Security Note
• https://osv.dev/vulnerability/CVE-2023-33964 · Vendor Advisory
• https://github.com/multiversx/mx-chain-go · Note