CVE-2021-21271: Uncontrolled resource consumption during consensus in github.com/tendermint/tendermint
Summary
CVE-2021-21271: Uncontrolled resource consumption during consensus in github.com/tendermint/tendermint. Affects github.com/tendermint/tendermint versions >= 0.34.0, < 0.34.3. Fixed in 0.34.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/tendermint/tendermint, which is written in Go. Tendermint is a Byzantine Fault Tolerant (BFT) consensus engine that enables secure and consistent replication of an application on multiple machines. It is commonly used as the consensus layer in blockchain systems. The vulnerability affects versions 0.34.0 to 0.34.2 of the package.
Vulnerability Detail
The vulnerability arises from the mishandling of timestamps during the consensus process in Tendermint. When different Tendermint nodes observe a different timestamp for a consensus evidence, it can lead to a mismatch and render the evidence invalid. As a result, the node producing the evidence will be requested to generate a new evidence. However, this new evidence will be identical to the previous one, causing it to be rejected again by other nodes involved in the consensus. This loop continues until the peer nodes decide to disconnect from the node producing the evidence. This vulnerability can be exploited to launch a denial of service attack, causing uncontrolled resource consumption and potentially disrupting the consensus process.
How To Fix
Minimum fixed version
0.34.3
This is the first release that contains the fix.
go get github.com/tendermint/tendermint@v0.34.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the package to mitigate the risk.
Conclusion
The vulnerability in github.com/tendermint/tendermint can lead to uncontrolled resource consumption during the consensus process, potentially causing a denial of service. To mitigate this risk, it is crucial to upgrade to version 0.34.3 or later of the package. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/tendermint/tendermint →
FAQ
Tendermint is a Byzantine Fault Tolerant (BFT) consensus engine used for secure and consistent replication of applications on multiple machines. It is commonly used as the consensus layer in blockchain systems.
This vulnerability can be exploited to launch a denial of service attack, causing uncontrolled resource consumption and potentially disrupting the consensus process in Tendermint-based systems.
Versions 0.34.0 to 0.34.2 of github.com/tendermint/tendermint are affected by this vulnerability.
No, there is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version of the package.
To fix this vulnerability, it is recommended to upgrade to version 0.34.3 or later of github.com/tendermint/tendermint.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/tendermint/tendermint.
