CVE-2017-9230 Other in n/a
A theoretical weakness in Bitcoin's Proof-of-Work algorithm allows optimized mining, though it is widely considered a benign optimization rather than a security vulnerability.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-9230?
CVE-2017-9230 is a high-severity vulnerability in n/a, published on 24 May 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Bitcoin Proof-of-Work algorithm does not consider a certain attack methodology related to 80-byte block headers with a variety of initial 64-byte chunks followed by the same 16-byte chunk, multiple candidate root values ending with the same 4 bytes, and calculations involving sqrt numbers. This violates the security assumptions of (1) the choice of input, outside of the dedicated nonce area, fed into the Proof-of-Work function should not change its difficulty to evaluate and (2) every Proof-of-Work function execution should be independent. NOTE: a number of persons feel that this methodology is a benign mining optimization, not a vulnerability
Weakness: CWE-338
Which versions are affected by CVE-2017-9230?
It affects 1 product.
Products include Bitcoin Bitcoin.
How do I fix CVE-2017-9230?
No fix has been published for CVE-2017-9230 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-9230 being exploited?
There is no known exploitation of CVE-2017-9230 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-hx58-x97g-cc9p.