GHSA-r9rv-9mh8-pxf4 Nervos CKB BlockTimeTooNew should not be considered as invalid block
An attacker can split the network by mining blocks slightly ahead of time, causing nodes to ban legitimate peers and disrupt connectivity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-r9rv-9mh8-pxf4?
GHSA-r9rv-9mh8-pxf4 is a denial of service vulnerability in ckb, published on 2 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
Currently, when a node receives a block in future according to its local wall clock, it will mark the block as invalid and ban the peer.
If the header's timestamp is more than 15 seconds ahead of our current time. In that case, the header may become valid in the future, and we don't want to disconnect a peer merely for serving us one too-far-ahead block header, to prevent an attacker from splitting the network by mining a block right at the 15 seconds boundary.
Patches
Upgrade to v0.33.1 or above.
Workarounds
Don't ban peer serving too-far-ahead block header.
Which versions are affected by GHSA-r9rv-9mh8-pxf4?
2 open source packages ship an affected version, including ckb.
| Package | Affected | Fixed in |
|---|---|---|
ckb crates.io | All versions | 0.33.1 |
ckb crates.io | All versions | 0.33.1 |
How do I fix GHSA-r9rv-9mh8-pxf4?
Upgrade ckb to 0.33.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-r9rv-9mh8-pxf4 being exploited?
There is no known exploitation of GHSA-r9rv-9mh8-pxf4 in the wild and no public exploit code.