PT-2023-24887 · Cometbft · Cometbft
Otrack
·
Published
2023-07-03
·
Updated
2023-07-17
·
CVE-2023-34451
CVSS v3.1
8.2
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H |
Name of the Vulnerable Software and Affected Versions
CometBFT versions v0.34.28 and prior, v0.37.0, v0.37.1
Description
The mempool in CometBFT maintains two data structures, a list and a map, to track outstanding transactions. These data structures are supposed to be in sync, with the map tracking the index of the transaction in the list. However, in affected versions, it is possible for these data structures to fall out of sync, leading to duplicate transactions that cannot be removed, even after they are committed in a block. The only way to remove the transaction is by restarting the node. This issue can be exploited by an attacker to bring down a node by repeatedly submitting duplicate transactions.
Recommendations
For versions v0.34.28 and prior, update to version v0.34.29 or later.
For versions v0.37.0 and v0.37.1, update to version v0.37.2 or later.
As a temporary workaround, consider increasing the value of
cache size in config.toml to make it difficult to effectively attack a full node.
Restrict access to the transaction submission RPCs to minimize the risk of exploitation.Exploit
Fix
Memory Leak
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cometbft