GHSA-m6gx-rhvj-fh52 Denial of service in go-ethereum due to CVE-2020-28362

Q: Which versions are affected by GHSA-m6gx-rhvj-fh52?

3 open source packages ship an affected version, including github.com/ethereum/go-ethereum.

Q: Is GHSA-m6gx-rhvj-fh52 being exploited?

There is no known exploitation of GHSA-m6gx-rhvj-fh52 in the wild and no public exploit code.

Q: How do I fix GHSA-m6gx-rhvj-fh52?

Upgrade github.com/ethereum/go-ethereum to 1.9.24 or later.

Not scored Published 29 Jun 2021

An attacker can crash Ethereum nodes by exploiting a Go runtime flaw, requiring operators to rebuild with patched Go versions.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-m6gx-rhvj-fh52?

GHSA-m6gx-rhvj-fh52 is a denial of service vulnerability in github.com/ethereum/go-ethereum, published on 29 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Impact

Versions of Geth built with Go <1.15.5 or <1.14.12 are most likely affected by a critical DoS-related security vulnerability. The golang team has registered the underlying flaw as ‘CVE-2020-28362’.

We recommend all users to rebuild (ideally v1.9.24) with Go 1.15.5 or 1.14.12, to avoid node crashes. Alternatively, if you are running binaries distributed via one of our official channels, we’re going to release v1.9.24 ourselves built with Go 1.15.5.

Patches

This is not an issue in go-ethereum, rebuilding an older version with Go 1.15.5 or 1.14.12 will suffice to address the vulnerability.

Workarounds

Rebuilding with Go 1.15.5 or 1.14.12 will suffice to address the vulnerability.

References

For more information

If you have any questions or comments about this advisory:

Open an issue in go-ethereum
Email us at [email protected]

Which versions are affected by GHSA-m6gx-rhvj-fh52?