PT-2024-27958 · Lnd · Lnd

Morehouse · Published 2024-06-20 · Updated 2024-07-01 · CVE-2024-38359

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Lightning Network Daemon (lnd) versions prior to 0.17.0

Description A parsing vulnerability in lnd's onion processing logic leads to a denial of service vector due to excessive memory allocation.

Recommendations For versions prior to 0.17.0, update to a version >= 0.17.0 to be protected. As a temporary workaround for users unable to upgrade, consider setting the --rejecthtlc CLI flag and also disable forwarding on channels via the UpdateChanPolicyCommand, or disable listening on a public network interface via the --nolisten flag to mitigate the issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2024-38359

GHSA-9GXX-58Q6-42P7

GO-2024-2943

Affected Products

Lnd

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/38xxx/CVE-2024-38359.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-38359 · Security Note
• https://osv.dev/vulnerability/CVE-2024-38359 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2943 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9gxx-58q6-42p7 · Vendor Advisory
• https://github.com/lightningnetwork/lnd/releases/tag/v0.17.0-beta · Note
• https://github.com/lightningnetwork/lnd/security/advisories/GHSA-9gxx-58q6-42p7 · Note
• https://github.com/lightningnetwork/lnd · Note
• https://morehouse.github.io/lightning/lnd-onion-bomb · Note
• https://twitter.com/CVEnew/status/1803918239036051604 · Twitter Post
• https://delvingbitcoin.org/t/dos-disclosure-lnd-onion-bomb/979 · Note
• https://t.me/cvenotify/83944 · Telegram Post
• https://lightning.network · Note