GHSA-w6rp-vxj2-fjhr Cosmos packet-forward-middleware vulnerable to chain-halt
An attacker can halt the blockchain network by exploiting non-deterministic errors in the Cosmos packet-forward-middleware module.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-w6rp-vxj2-fjhr?
GHSA-w6rp-vxj2-fjhr is a denial of service vulnerability in github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v4, published on 26 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Cosmos SDK is used for Inter-Blockchain Communication Protocol (IBC) applications and middleware. The packet-forward-middleware module is an IBC middleware module built for Cosmos blockchains utilizing the IBC protocol allowing routing of incoming IBC packets from a source chain to a destination chain. The packet-forward-middleware module is vulnerable to potential chain-halt due to error non-determinism.
Patches
Please patch at your earliest convenience by applying one of the following patch versions, respective to the chain's ibc-go major version: v4.1.1 v5.2.1 v6.1.1
Which versions are affected by GHSA-w6rp-vxj2-fjhr?
9 open source packages ship an affected version, including github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v4, github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v5 and github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v6.
| Package | Affected | Fixed in |
|---|---|---|
github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v4 Go | All versions | 4.1.1 |
github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v4 Go | All versions | 4.1.1 |
github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v4 Go | All versions | 4.1.1 |
github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v5 Go | All versions | 5.2.1 |
github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v5 Go | All versions | 5.2.1 |
github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v5 Go | All versions | 5.2.1 |
3 more packages
github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v6 Go | All versions | 6.1.1 |
github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v6 Go | All versions | 6.1.1 |
github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v6 Go | All versions | 6.1.1 |
How do I fix GHSA-w6rp-vxj2-fjhr?
Upgrade github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v4 to 4.1.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-w6rp-vxj2-fjhr being exploited?
There is no known exploitation of GHSA-w6rp-vxj2-fjhr in the wild and no public exploit code.
Sources
Also known as GO-2023-2156.