CVE-2020-26241 Shallow copy bug in geth

What is CVE-2020-26241?

CVE-2020-26241 is a medium-severity vulnerability in go-ethereum, published on 25 Nov 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. This is a Consensus vulnerability in Geth before version 1.9.17 which can be used to cause a chain-split where vulnerable nodes reject the canonical chain. Geth's pre-compiled dataCopy (at 0x00...04) contract did a shallow copy on invocation. An attacker could deploy a contract that writes X to an EVM memory region R, then calls 0x00..04 with R as an argument, then overwrites R to Y, and finally invokes the RETURNDATACOPY opcode. When this contract is invoked, a consensus-compliant node would push X on the EVM stack, whereas Geth would push Y. This is fixed in version 1.9.17.

Weakness: CWE-682

Which versions are affected by CVE-2020-26241?

3 open source packages ship an affected version, including github.com/ethereum/go-ethereum. It affects 1 product.

Products include Ethereum Go Ethereum.

How do I fix CVE-2020-26241?

Upgrade github.com/ethereum/go-ethereum to 1.9.17 or later.

Is CVE-2020-26241 being exploited?

There is no known exploitation of CVE-2020-26241 in the wild and no public exploit code.

Other vulnerabilities in go-ethereum

• CVE-2026-26314 Go Ethereum affected by DoS via malicious p2p message High 8.7
• CVE-2023-42319 go-ethereum vulnerable to denial of service via crafted GraphQL query High 7.5
• CVE-2023-40591 Denial of service via malicious p2p message in go-ethereum High 7.5
• CVE-2021-42219 Denial of service in go-ethereum High 7.5
• CVE-2022-23327 Denial of Service in Go-Ethereum High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-69v6-xc2j-r2jf, GO-2022-0771.