CVE-2020-26242: Denial of Service in go-ethereum
Summary
CVE-2020-26242: Denial of service in github.com/holiman/uint256. Affects github.com/holiman/uint256 versions >= 0.1.0, < 1.1.1. Fixed in 1.1.1. How to fix ↓
Also tracked for
The same CVE-2020-26242 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
go-ethereum is an open-source implementation of the Ethereum protocol written in Go. It is widely used as a client for interacting with the Ethereum blockchain. The vulnerability in go-ethereum allows for a denial-of-service attack during block processing.
Vulnerability Detail
The vulnerability in go-ethereum is caused by a flaw in the uint256 library, which was merged into go-ethereum on June 8, 2020. The vulnerability can be exploited by specifying a modulo of 0 in the MULMOD operation, resulting in a panic in the library. This panic occurs due to a buffer underflow in the uint256 library, where a negative index is accessed. Exploiting this vulnerability can cause all vulnerable nodes to drop off the network, resulting in a denial-of-service condition. The vulnerability was reported through a bug report on the Ropsten network.
How To Fix
Minimum fixed version
1.1.1
This is the first release that contains the fix.
go get github.com/holiman/uint256@v1.1.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the patched version of go-ethereum.
Conclusion
The vulnerability in go-ethereum can be exploited to cause a denial-of-service condition. It is recommended to upgrade to the patched version of go-ethereum to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/holiman/uint256 →
FAQ
go-ethereum is an open-source implementation of the Ethereum protocol written in Go. It is used as a client for interacting with the Ethereum blockchain.
The vulnerability can be exploited to cause a denial-of-service condition, resulting in vulnerable nodes dropping off the network.
To fix this vulnerability, upgrade to go-ethereum version 1.9.18 or higher.
There is no known workaround for this vulnerability. It is recommended to upgrade to the patched version of go-ethereum.
This vulnerability was discovered through a bug report on the Ropsten network.
