GHSA-wjxc-pjx9-4wvm Nervos CKB Panic on malformed input
Remote attackers can crash the Nervos CKB node by sending malformed P2P messages, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-wjxc-pjx9-4wvm?
GHSA-wjxc-pjx9-4wvm is a denial of service vulnerability in ckb, published on 3 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
CKB process will panic when received malformed p2p message because of snappy, which is used to compress network messages
References
Which versions are affected by GHSA-wjxc-pjx9-4wvm?
2 open source packages ship an affected version, including ckb.
| Package | Affected | Fixed in |
|---|---|---|
ckb crates.io | All versions | 0.34.2 |
ckb crates.io | All versions | 0.34.2 |
How do I fix GHSA-wjxc-pjx9-4wvm?
Upgrade ckb to 0.34.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-wjxc-pjx9-4wvm being exploited?
There is no known exploitation of GHSA-wjxc-pjx9-4wvm in the wild and no public exploit code.