CVE-2018-1000618 Denial of service in n/a
A stack overflow in the ABI serializer allows remote attackers to crash EOSIO network nodes via crafted network requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-1000618?
CVE-2018-1000618 is a critical denial of service vulnerability in n/a, published on 9 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
EOSIO/eos eos version after commit f1545dd0ae2b77580c2236fdb70ae7138d2c7168 contains a stack overflow vulnerability in abi_serializer that can result in attack eos network node. This attack appear to be exploitable via network request. This vulnerability appears to have been fixed in after commit cf7209e703e6d3f7a5413e0cb1fe88a4d8e4b38d .
Weakness: CWE-674
Which versions are affected by CVE-2018-1000618?
It affects 1 product.
Products include Eosio Project Eos.
How do I fix CVE-2018-1000618?
No fix has been published for CVE-2018-1000618 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-1000618 being exploited?
There is no known exploitation of CVE-2018-1000618 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-5frv-4h27-cphv.