CVE-2022-29177
DoS via malicious p2p message in Go Ethereum
Impact
### Impact A vulnerable node, if configured to use high verbosity logging, can be made to crash when handling specially crafted p2p messages sent from an attacker node. ### Patches The following PR addresses the problem: https://github.com/ethereum/go-ethereum/pull/24507 ### Workarounds Aside from applying the PR linked above, setting loglevel to default level (`INFO`) makes the node not vulnerable to this attack. ### Credits This bug was reported by `nrv` via bounty@ethereum.org, who has gracefully requested that the bounty rewards be donated to Médecins sans frontières. ### For more information If you have any questions or comments about this advisory: * Open an issue in [go-ethereum](https://github.com/ethereum/go-ethereum)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/ethereum/go-ethereum | < 1.10.17 | 1.10.17 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ethereum | Go Ethereum | before 1.10.17 |