GHSA-9mfc-chwf-7whf ckb: Large dep group requires a lot of resources to process but the cost to commit the transaction is very low.
Attackers can cause resource exhaustion and denial of service by submitting transactions with large dependency groups, affecting CKB blockchain nodes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-9mfc-chwf-7whf?
GHSA-9mfc-chwf-7whf is a denial of service vulnerability in ckb, published on 2 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
When a transaction contains a dep group with many cells, the resources required to process it are not linear to the transaction size nor spent script cycles.
Patches
In 0.43.3, nodes drop the transactions relayed to them when they contain a dep group with more than 64 cells. They do not ban peers who send them such transactions.
In 0.100, the consensus disallow transactions using a dep group with more than 64 cells. Peers relaying such transaction must be banned. Blocks committing such transactions must be rejected.
Which versions are affected by GHSA-9mfc-chwf-7whf?
2 open source packages ship an affected version, including ckb.
| Package | Affected | Fixed in |
|---|---|---|
ckb crates.io | All versions | 0.43.3 |
ckb crates.io | All versions | 0.43.3 |
How do I fix GHSA-9mfc-chwf-7whf?
Upgrade ckb to 0.43.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-9mfc-chwf-7whf being exploited?
There is no known exploitation of GHSA-9mfc-chwf-7whf in the wild and no public exploit code.