GHSA-p5gc-957x-gfw9

    Dashboard / Vulnerabilities / GHSA-p5gc-957x-gfw9

    GHSA-p5gc-957x-gfw9

    Published: 14 May 2022Last Modified: 20 May 2024

    Summary: Go Ethereum LES protocol implementation vulnerable to Denial of Service

    Details: The GetBlockHeadersMsg handler in the LES protocol implementation in Go Ethereum (aka geth) before 1.8.11 may lead to an access violation because of an integer signedness error for the array index, which allows attackers to launch a Denial of Service attack by sending a packet with a -1 query.Skip value. The vulnerable remote node would be crashed by such an attack immediately, aka the EPoD (Ethereum Packet of Death) issue. ### Specific Go Packages Affected github.com/ethereum/go-ethereum/les

    References: https://nvd.nist.gov/vuln/detail/CVE-2018-12018, https://github.com/ethereum/go-ethereum/pull/16891, https://github.com/ethereum/go-ethereum/commit/a5237a27eaf81946a3edb4fafe13ed6359d119e4, https://github.com/ethereum/go-ethereum, https://github.com/ethereum/go-ethereum/releases/tag/v1.8.11, https://peckshield.com/2018/06/27/EPoD, https://pkg.go.dev/vuln/GO-2021-0075, https://web.archive.org/web/20180628022133/https://peckshield.com/2018/06/27/EPoD

    Affected packages

    Package

    Name: github.com/ethereum/go-ethereum

    Purl: pkg:golang/github.com/ethereum/go-ethereum

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -1.8.11

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High