GHSA-j35p-q24r-5367 Dep Group Remote Memory Exhaustion (Denial of Service) in ckb
Remote attackers can exhaust memory in CKB nodes by sending transactions with duplicate outpoints, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-j35p-q24r-5367?
GHSA-j35p-q24r-5367 is a denial of service vulnerability in ckb, published on 22 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
A remote attacker could exploit this vulnerability to exhaust ckb process memory of an affected node.
Patches
Upgrade to 0.43.1 or later.
References
After resolving the outpoints of one dep group, we put the corresponding content into a vec ( https://github.com/nervosnetwork/ckb/blob/v0.42.0/util/types/src/core/cell.rs#L600-L617 ), there is a vulnerability to a memory dos attack because there is no determination of whether the outpoints is duplicated.
PoC:
before send dos tx rss:
105700
after rss:
2306932
DoS cost: 25.6 KB * 150 + dep_tx out_points capacity ( 36 * 150 * 100 = 540000 ) = 4380000 CKB Send 50 dos_tx, memory exhausted: (25.6 KB * 150 * 100) * 50 = 19.2 GB
Which versions are affected by GHSA-j35p-q24r-5367?
2 open source packages ship an affected version, including ckb.
| Package | Affected | Fixed in |
|---|---|---|
ckb crates.io | All versions | 0.43.1 |
ckb crates.io | All versions | 0.43.1 |
How do I fix GHSA-j35p-q24r-5367?
Upgrade ckb to 0.43.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-j35p-q24r-5367 being exploited?
There is no known exploitation of GHSA-j35p-q24r-5367 in the wild and no public exploit code.