CVE-2021-43668 Denial of Service in Go-Ethereum
Remote attackers can crash Go-Ethereum nodes via crafted messages, causing a denial of service due to a null pointer dereference.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-43668?
CVE-2021-43668 is a medium-severity vulnerability in n/a, published on 18 Nov 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Go-Ethereum 1.10.9 nodes crash (denial of service) after receiving a serial of messages and cannot be recovered. They will crash with "runtime error: invalid memory address or nil pointer dereference" and arise a SEGV signal.
Weakness: CWE-476
Which versions are affected by CVE-2021-43668?
2 open source packages ship an affected version, including github.com/ethereum/go-ethereum. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/ethereum/go-ethereum Go | All versions to 1.10.9 | None |
github.com/ethereum/go-ethereum Go | All versions to 1.10.9 | None |
Products include Ethereum Go Ethereum.
How do I fix CVE-2021-43668?
No fix has been published for CVE-2021-43668 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-43668 being exploited?
There is no known exploitation of CVE-2021-43668 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2026-26314 Go Ethereum affected by DoS via malicious p2p message
- CVE-2023-42319 go-ethereum vulnerable to denial of service via crafted GraphQL query
- CVE-2023-40591 Denial of service via malicious p2p message in go-ethereum
- CVE-2021-42219 Denial of service in go-ethereum
- CVE-2022-23327 Denial of Service in Go-Ethereum
Sources
Also known as GHSA-5m8f-chrv-7rw5, UBUNTU-CVE-2021-43668.