CVE-2021-45700 Process crashes when the cell used as DepGroup is not alive
Attackers can crash the Nervos CKB blockchain node by submitting a dead call as a DepGroup, requiring an upgrade of the ckb crate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-45700?
CVE-2021-45700 is a high-severity denial of service vulnerability in n/a, published on 26 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the ckb crate before 0.40.0 for Rust. Attackers can cause a denial of service (Nervos CKB blockchain node crash) via a dead call that is used as a DepGroup.
Which versions are affected by CVE-2021-45700?
5 open source packages ship an affected version, including ckb. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ckb crates.io | All versions | 0.40.0 |
ckb crates.io | All versions | 0.40.0 |
ckb crates.io | All versions | 0.40.0 |
ckb crates.io | All versions | 0.40.0 |
ckb crates.io | From 0.0.0-0 | 0.40.0 |
Products include Nervos Ckb.
How do I fix CVE-2021-45700?
Upgrade ckb to 0.40.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-45700 being exploited?
There is no known exploitation of CVE-2021-45700 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-45p7-c959-rgcm, GHSA-cw98-cx2m-9qqg, RUSTSEC-2021-0109.