GHSA-7fw6-6mfj-g3q2 ckb: Transaction header_deps validation issue (network forking)
Attackers can cause network forking by submitting transactions with invalid header dependencies, disrupting consensus in CKB nodes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-7fw6-6mfj-g3q2?
GHSA-7fw6-6mfj-g3q2 is a vulnerability in ckb, published on 2 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
fn HeaderChecker#check_valid skipped main chain checking after this PR: https://github.com/nervosnetwork/ckb/pull/1646/files#diff-c4e017b67c1b3005ca0c446a9b0879571aa36a858b1f7ddd1b9328a884e3214bR171-R176
It will cause network forking if one transaction is using a forked block header which is not exists in local node's storage.
Patches
0.101.1 and later versions
Which versions are affected by GHSA-7fw6-6mfj-g3q2?
2 open source packages ship an affected version, including ckb.
| Package | Affected | Fixed in |
|---|---|---|
ckb crates.io | All versions | 0.101.1 |
ckb crates.io | All versions | 0.101.1 |
How do I fix GHSA-7fw6-6mfj-g3q2?
Upgrade ckb to 0.101.1 or later.
Is GHSA-7fw6-6mfj-g3q2 being exploited?
There is no known exploitation of GHSA-7fw6-6mfj-g3q2 in the wild and no public exploit code.