CVE-2022-23327: Denial of Service in Go-Ethereum
Summary
CVE-2022-23327: Denial of Service in Go-Ethereum. Affects github.com/ethereum/go-ethereum versions < 1.10.12. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Go-Ethereum is an open-source implementation of the Ethereum protocol written in the Go programming language. It provides a platform for developers to build decentralized applications (dApps) on the Ethereum blockchain. Go-Ethereum is widely used and trusted by the Ethereum community for its robustness and performance. However, a design flaw in versions 1.10.12 and older allows an attacker node to exploit the system and cause a denial of service (DoS) by flooding a victim node's memory pool with a large number of future transactions.
Vulnerability Detail
The vulnerability in Go-Ethereum arises from a flaw in the way it handles incoming transactions. An attacker can send a single message containing 5120 future transactions with a high gas price. When the victim node receives this message, it processes each transaction and adds it to its memory pool. However, due to the large number of transactions and their high gas price, the victim node's memory pool becomes overwhelmed and purges all pending transactions. This results in a denial of service, as legitimate transactions are discarded and unable to be processed. The impact of this vulnerability can be severe, as it can disrupt the normal functioning of the victim node and potentially affect the entire Ethereum network.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating to a non-vulnerable version of Go-Ethereum.
Conclusion
The vulnerability in Go-Ethereum allows an attacker to cause a denial of service by flooding a victim node's memory pool with a large number of future transactions. To mitigate this risk, it is crucial to update to a non-vulnerable version of Go-Ethereum. Upgrading to Go-Ethereum 1.10.13 or newer will ensure that your installation is protected against this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/ethereum/go-ethereum →
FAQ
The vulnerability allows an attacker to cause a denial of service (DoS) by flooding a victim node's memory pool with a large number of future transactions. This can disrupt the normal functioning of the victim node and potentially affect the entire Ethereum network.
To protect your Go-Ethereum installation, it is crucial to update to a version that is not affected by this vulnerability. Upgrade to Go-Ethereum 1.10.13 or newer.
No, there are no known workarounds for this vulnerability. It is necessary to update to a non-vulnerable version of Go-Ethereum.
Yes, this vulnerability affects Go-Ethereum versions 1.10.12 and older. It has been addressed in versions 1.10.13 and newer.
Yes, an attacker can exploit this vulnerability remotely by sending a specially crafted message to a victim node.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/ethereum/go-ethereum.
