CVE-2022-23328: Denial of Service in Go-Ethereum
Summary
CVE-2022-23328: Denial of Service in Go-Ethereum. Affects github.com/ethereum/go-ethereum versions < 1.10.16. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Go-Ethereum is an open-source implementation of the Ethereum protocol written in Go. It is widely used for building decentralized applications (dApps) and interacting with the Ethereum blockchain. Go-Ethereum provides various functionalities such as transaction processing, smart contract execution, and network communication. However, a design flaw in all versions of Go-Ethereum allows an attacker node to exploit a vulnerability that can lead to a denial of service (DoS) attack.
Vulnerability Detail
The vulnerability in Go-Ethereum arises from a design flaw that enables an attacker node to send a large number of pending transactions with a high gas price from one account to a victim Geth node. These transactions fully spend the balance of the account and overwhelm the victim node's memory pool. As a result, the victim node's memory pool is purged of all pending transactions, and new transactions are prevented from entering the pool. This leads to a denial of service, where the victim node becomes unresponsive and unable to process further transactions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of Go-Ethereum to mitigate the risk of a denial of service attack.
Conclusion
The vulnerability in Go-Ethereum allows an attacker to launch a denial of service attack by overwhelming a victim node's memory pool with malicious transactions. To mitigate this risk, users should update their Go-Ethereum installation to version 1.10.17 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/ethereum/go-ethereum →
FAQ
The vulnerability allows an attacker to launch a denial of service attack on a Go-Ethereum node, rendering it unresponsive and unable to process transactions.
Yes, this vulnerability can be exploited remotely by an attacker node sending malicious transactions to a victim Geth node over the network.
Yes, all versions of Go-Ethereum up to and including version 1.10.16 are affected by this vulnerability.
Yes, the vulnerability has been fixed in version 1.10.17 of Go-Ethereum. Users should update their installation to the latest version to protect against this vulnerability.
No, there is no known workaround for this vulnerability. Updating to the fixed version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/ethereum/go-ethereum.
