GHSA-84x2-2qv6-qg56 Nervos CKB P2P DoS Attacks
Attackers can cause denial of service on Nervos CKB nodes by flooding the P2P network with random transaction hashes due to missing rate limits.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-84x2-2qv6-qg56?
GHSA-84x2-2qv6-qg56 is a denial of service vulnerability in ckb, published on 2 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The P2P protocols lack of rate limit. For example, in relay protocol, when a node receives a broadcasted tx_hashes, it will mark it in memory to avoid duplicated requests. code → .
It is easy to establish a DoS attach by generating random tx hashes.
Impact
It affects all nodes connected to the P2P network.
Workarounds
Apply rate limit on the data sent to CKB P2P port.
Which versions are affected by GHSA-84x2-2qv6-qg56?
2 open source packages ship an affected version, including ckb.
| Package | Affected | Fixed in |
|---|---|---|
ckb crates.io | All versions | 0.34.0 |
ckb crates.io | All versions | 0.34.0 |
How do I fix GHSA-84x2-2qv6-qg56?
Upgrade ckb to 0.34.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-84x2-2qv6-qg56 being exploited?
There is no known exploitation of GHSA-84x2-2qv6-qg56 in the wild and no public exploit code.