CVE-2020-5303: Denial of Service in Tendermint p2p
Summary
CVE-2020-5303: Denial of service in Tendermint. Affects github.com/tendermint/tendermint across 3 version ranges.
< 0.31.12
>= 0.32.0, < 0.32.10
>= 0.33.0, < 0.33.3
Fixed in 0.31.12, 0.32.10 or 0.33.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Tendermint is a Go-based package that provides a Byzantine Fault Tolerant (BFT) consensus algorithm for building distributed applications. It allows multiple nodes to agree on the state of a shared database, ensuring consistency and fault tolerance. The p2p module in Tendermint handles peer-to-peer communication between nodes, facilitating the exchange of messages and synchronization of data. However, versions 0.33.2 and earlier of Tendermint's p2p module are vulnerable to a Denial of Service (DoS) attack.
Vulnerability Detail
The vulnerability in Tendermint's p2p module can be exploited in two ways. Firstly, it does not limit the number of P2P connection requests, leading to memory spikes and potential Out-Of-Memory (OOM) exceptions. This can be abused by an attacker to exhaust system resources and disrupt the functioning of full nodes. Secondly, the module fails to reclaim the 'activeID' of a peer after it is removed, resulting in a continuously growing memory usage. If an attacker creates numerous connection attempts, the 'activeIDs' map can reach its maximum size, causing the node to panic. Both vulnerabilities can be executed independently and pose a risk to all full nodes, except for validators behind closed networks.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 0.31.120.31.12go get github.com/tendermint/tendermint@v0.31.12 -
>= 0.32.0, < 0.32.100.32.10go get github.com/tendermint/tendermint@v0.32.10 -
>= 0.33.0, < 0.33.30.33.3go get github.com/tendermint/tendermint@v0.33.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No workarounds are available for these vulnerabilities. It is essential to apply the provided patches to eliminate the risk of exploitation.
Conclusion
The vulnerabilities in Tendermint's p2p module can have severe consequences for the stability and security of full nodes. It is crucial to promptly update to the patched versions to eliminate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/tendermint/tendermint →
FAQ
Tendermint is a Go-based package that provides a Byzantine Fault Tolerant (BFT) consensus algorithm for building distributed applications.
Versions 0.33.2 and earlier of Tendermint's p2p module are vulnerable to the Denial of Service (DoS) attack.
The vulnerabilities can lead to memory spikes, Out-Of-Memory (OOM) exceptions, and system panics, causing disruption to the functioning of full nodes.
Validators behind closed networks are not at risk from these vulnerabilities.
To mitigate the vulnerabilities, it is recommended to update to the patched versions of Tendermint (0.33.3, 0.32.10, or 0.31.12).
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/tendermint/tendermint.
