GHSA-fjj4-2q73-jvgc Nervos CKB calculation of program load cycles may be missed when executing in resume mode
An attacker can cause missed cycle calculations in resume mode, potentially leading to denial of service in Nervos CKB script execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-fjj4-2q73-jvgc?
GHSA-fjj4-2q73-jvgc is a denial of service vulnerability in ckb, published on 8 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
The calculation of program load cycles may be missed when executing in resume mode. Since the script execution order is now determined, this issue does not cause network splitting.
Which versions are affected by GHSA-fjj4-2q73-jvgc?
2 open source packages ship an affected version, including ckb.
| Package | Affected | Fixed in |
|---|---|---|
ckb crates.io | From 0.100.0 | None |
ckb crates.io | From 0.100.0 | None |
How do I fix GHSA-fjj4-2q73-jvgc?
No fix has been published for GHSA-fjj4-2q73-jvgc yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-fjj4-2q73-jvgc being exploited?
There is no known exploitation of GHSA-fjj4-2q73-jvgc in the wild and no public exploit code.