CVE-2024-34478 btcd susceptible to consensus failures

What is CVE-2024-34478?

CVE-2024-34478 is a high-severity vulnerability in n/a, published on 5 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failures. Specifically, it uses the transaction version as a signed integer when it is supposed to be treated as unsigned. There can be a chain split and loss of funds.

Weakness: CWE-436

Which versions are affected by CVE-2024-34478?

3 open source packages ship an affected version, including github.com/btcsuite/btcd. It affects 1 product.

Products include Btcd Project Btcd.

How do I fix CVE-2024-34478?

Upgrade github.com/btcsuite/btcd to 0.24.0 or later.

Is CVE-2024-34478 being exploited?

There is no known exploitation of CVE-2024-34478 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2022-44797 btcd mishandles witness size checking Critical 9.8
• CVE-2022-39389 Witness Block Parsing DoS Vulnerability in lnd High 8.2
• CVE-2024-38365 btcd did not correctly re-implement Bitcoin Core's "FindAndDelete()" functionality High 7.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3jgf-r68h-xfqm, GO-2024-2818.