CVE-2020-5303 Denial of service in Tendermint
An attacker can cause a denial of service in Tendermint by exhausting memory through uncontrolled P2P connection requests and activeID leaks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-5303?
CVE-2020-5303 is a low-severity denial of service vulnerability in Tendermint, published on 10 Apr 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Tendermint before versions 0.33.3, 0.32.10, and 0.31.12 has a denial-of-service vulnerability. Tendermint does not limit the number of P2P connection requests. For each p2p connection, it allocates XXX bytes. Even though this memory is garbage collected once the connection is terminated (due to duplicate IP or reaching a maximum number of inbound peers), temporary memory spikes can lead to OOM (Out-Of-Memory) exceptions. Additionally, Tendermint does not reclaim activeID of a peer after it's removed in Mempool reactor. This does not happen all the time. It only happens when a connection fails (for any reason) before the Peer is created and added to all reactors. RemovePeer is therefore called before AddPeer, which leads to always growing memory (activeIDs map). The activeIDs map has a maximum size of 65535 and the node will panic if this map reaches the maximum. An attacker can create a lot of connection attempts (exploiting above denial of service), which ultimately will lead to the node panicking. These issues are patched in Tendermint 0.33.3 and 0.32.10.
Which versions are affected by CVE-2020-5303?
6 open source packages ship an affected version, including github.com/tendermint/tendermint. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/tendermint/tendermint Go | All versions | 0.31.12 |
github.com/tendermint/tendermint Go | All versions | 0.31.12 |
github.com/tendermint/tendermint Go | From 0.32.0 | 0.32.10 |
github.com/tendermint/tendermint Go | From 0.32.0 | 0.32.10 |
github.com/tendermint/tendermint Go | From 0.33.0 | 0.33.3 |
github.com/tendermint/tendermint Go | From 0.33.0 | 0.33.3 |
Products include Tendermint Tendermint.
How do I fix CVE-2020-5303?
Upgrade github.com/tendermint/tendermint to a fixed version for your release line: 0.31.12, 0.32.10 or 0.33.3.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-5303 being exploited?
There is no known exploitation of CVE-2020-5303 in the wild and no public exploit code.
Other vulnerabilities in Tendermint
Sources
Also known as GHSA-v24h-pjjv-mcp6.