PT-2024-25019 · Unknown · Go-Ethereum
Donghan Kim
·
Published
2024-05-06
·
Updated
2025-01-09
·
CVE-2024-32972
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
go-ethereum (geth) versions prior to 1.13.15
Description
A vulnerable node can be made to consume very large amounts of memory when handling specially crafted p2p messages sent from an attacker node, potentially resulting in a denial of service as the node runs out of memory. The attack involves establishing a peer connection to the victim and sending a malicious
GetBlockHeadersRequest message with a count of 0 using the ETH protocol, which due to integer overflow, allows an attacker to bypass maxHeadersServe and request all headers from the latest block back to the genesis block.Recommendations
For go-ethereum (geth) versions prior to 1.13.15, update to version 1.13.15 or later to resolve the issue. As a temporary workaround, consider restricting peer connections to trusted nodes to minimize the risk of exploitation. Avoid using the
GetBlockHeadersRequest message with a count of 0 until the issue is resolved.Exploit
Fix
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Go-Ethereum