CVE-2018-19184: Denial of Service in geth
Summary
CVE-2018-19184: Go Ethereum Denial of Service. Affects github.com/ethereum/go-ethereum versions < 1.8.14. Fixed in 1.8.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The affected package is github.com/ethereum/go-ethereum/cmd/evm, which is part of the Go Ethereum (geth) project. Geth is an implementation of the Ethereum protocol in the Go programming language. It provides a command-line interface for interacting with the Ethereum network and running Ethereum smart contracts. The evm package is responsible for executing Ethereum Virtual Machine (EVM) bytecode. The vulnerability allows attackers to cause a denial of service (SEGV) by exploiting a flaw in the runner.go file.
Vulnerability Detail
The vulnerability in cmd/evm/runner.go allows attackers to trigger a denial of service (SEGV) by providing crafted bytecode. This can lead to the geth process crashing, resulting in a disruption of service. The vulnerability is rated as HIGH severity with a CVSS score of 7.5. The specific CWE associated with this vulnerability is CWE-476. The vulnerability was first introduced in version 0 of the package and was fixed in version 1.8.14.
How To Fix
Minimum fixed version
1.8.14
This is the first release that contains the fix.
go get github.com/ethereum/go-ethereum@v1.8.14Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the fixed version as soon as possible.
Conclusion
The vulnerability in the cmd/evm/runner.go file of the geth package allows attackers to cause a denial of service by providing crafted bytecode. To mitigate the risk, it is crucial to update the affected package to version 1.8.14 or later. No known workarounds exist for this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/ethereum/go-ethereum →
FAQ
The vulnerability allows attackers to cause a denial of service by crashing the geth process. This can result in a disruption of service and potential financial losses for Ethereum applications relying on geth.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file and the playground will analyze it for open-source vulnerabilities, including this one.
There is no known public exploit for this vulnerability at the time of this report. However, it is important to update to the fixed version to prevent any potential exploitation.
No, updating to the fixed version is the recommended way to mitigate the risk. There are no known workarounds for this vulnerability.
This vulnerability specifically affects the geth client. It is recommended to update geth to the fixed version. Other Ethereum clients may have their own vulnerabilities, so it is important to keep all software up to date.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/ethereum/go-ethereum.
