CVE-2021-45699 Allocation of Resources Without Limits or Throttling in ckb

What is CVE-2021-45699?

CVE-2021-45699 is a high-severity denial of service vulnerability in n/a, published on 26 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in the ckb crate before 0.40.0 for Rust. Remote attackers may be able to conduct a 51% attack against the Nervos CKB blockchain by triggering an inability to allocate memory for the misbehavior HashMap.

Weakness: CWE-770

Which versions are affected by CVE-2021-45699?

5 open source packages ship an affected version, including ckb. It affects 1 product.

Products include Nervos Ckb.

How do I fix CVE-2021-45699?

Upgrade ckb to 0.40.0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-45699 being exploited?

There is no known exploitation of CVE-2021-45699 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2021-45698 RPC call failure in ckb Critical 9.8
• CVE-2021-45700 Process crashes when the cell used as DepGroup is not alive High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as GHSA-2969-8hh9-57jc, GHSA-48vq-8jqv-gm6f, RUSTSEC-2021-0108.