CVE-2023-42806 Snapshot signature not including HeadID will allow replay attacks
Attackers can replay old snapshots to cause denial of service or incorrect value distribution in Hydra heads by exploiting missing signature verification.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-42806?
CVE-2023-42806 is a medium-severity vulnerability in input-output-hk hydra, published on 21 Sep 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Hydra is the layer-two scalability solution for Cardano. Prior to version 0.13.0, not signing and verifying `$\mathsf{cid}$` allows an attacker (which must be a participant of this head) to use a snapshot from an old head instance with the same participants to close the head or contest the state with it. This can lead to an incorrect distribution of value (= value extraction attack; hard, but possible) or prevent the head to finalize because the value available is not consistent with the closed utxo state (= denial of service; easy). A patch is planned for version 0.13.0. As a workaround, rotate keys between heads so not to re-use keys and not result in the same multi-signature participants.
Weakness: CWE-347
Which versions are affected by CVE-2023-42806?
It affects 1 product.
Products include Iohk Hydra.
How do I fix CVE-2023-42806?
No fix has been published for CVE-2023-42806 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-42806 being exploited?
There is no known exploitation of CVE-2023-42806 in the wild and no public exploit code.
Other vulnerabilities in input-output-hk hydra
Sources
Also known as GHSA-gr36-mc6v-72qq.