CVE-2023-40591
Go-Ethereum vulnerable to denial of service via malicious p2p message
Impact
### Impact A vulnerable node, can be made to consume unbounded amounts of memory when handling specially crafted p2p messages sent from an attacker node. ### Details The p2p handler spawned a new goroutine to respond to `ping` requests. By flooding a node with ping requests, an unbounded number of goroutines can be created, leading to resource exhaustion and potentially crash due to OOM. ### Patches The fix is included in geth version `1.12.1-stable`, i.e, `1.12.2-unstable` and onwards. Fixed by https://github.com/ethereum/go-ethereum/pull/27887 ### Workarounds No known workarounds. ### Credits This bug was reported by Patrick McHardy and reported via [bounty@ethereum.org](mailto:bounty@ethereum.org). ### References
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/ethereum/go-ethereum | < 1.12.1-stable | 1.12.1-stable |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ethereum | Go Ethereum | from 1.10.0 before 1.12.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://geth.ethereum.org/docs/developers/geth-developer/disclosures
- https://github.com/ethereum/go-ethereum/releases/tag/v1.12.1
- https://github.com/ethereum/go-ethereum/security/advisories/GHSA-ppjg-v974-84cm
- https://github.com/advisories/GHSA-ppjg-v974-84cm
- https://nvd.nist.gov/vuln/detail/CVE-2023-40591