PT-2023-28592 · Cardano · Hydra

Jmhrpr · Published 2023-09-21 · Updated 2023-10-03 · CVE-2023-42806

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hydra versions prior to 0.13.0

Description Hydra is the layer-two scalability solution for Cardano. Not signing and verifying cid allows an attacker, who must be a participant of this head, to use a snapshot from an old head instance with the same participants to close the head or contest the state with it. This can lead to an incorrect distribution of value, resulting in a value extraction attack, or prevent the head from finalizing due to inconsistent value availability, causing a denial of service.

Recommendations For versions prior to 0.13.0, as a temporary workaround, consider rotating keys between heads to avoid reusing keys and resulting in the same multi-signature participants. A patch is planned for version 0.13.0.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2023-42806

GHSA-GR36-MC6V-72QQ

Affected Products

Hydra

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42806.json · Exploit
• https://github.com/input-output-hk/hydra/security/advisories/GHSA-gr36-mc6v-72qq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-42806 · Security Note
• https://osv.dev/vulnerability/CVE-2023-42806 · Vendor Advisory
• https://github.com/input-output-hk/hydra/blob/ec6c7a2ab651462228475d0b34264e9a182c22bb/hydra-node/src/Hydra/HeadLogic.hs#L357 · Note
• https://github.com/input-output-hk/hydra/blob/ec6c7a2ab651462228475d0b34264e9a182c22bb/hydra-plutus/src/Hydra/Contract/Head.hs#L583-L599 · Note
• https://github.com/input-output-hk/hydra/blob/ec6c7a2ab651462228475d0b34264e9a182c22bb/hydra-node/src/Hydra/Snapshot.hs#L50-L54 · Note
• https://twitter.com/VulmonFeeds/status/1704931765767319747 · Twitter Post
• https://twitter.com/CVEnew/status/1704901538647265438 · Twitter Post
• https://twitter.com/SkintWTF/status/1709090458599612709 · Twitter Post
• https://t.me/cibsecurity/70909 · Telegram Post
• https://twitter.com/Volt_Pool/status/1709187785540751400 · Twitter Post