Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1qMzVwLXEyNHItNTM2N80_ng

Dep Group Remote Memory Exhaustion (Denial of Service) in ckb

Impact

A remote attacker could exploit this vulnerability to exhaust ckb process memory of an affected node.

Patches

Upgrade to 0.43.1 or later.

References

After resolving the outpoints of one dep group, we put the corresponding content into a vec ( https://github.com/nervosnetwork/ckb/blob/v0.42.0/util/types/src/core/cell.rs#L600-L617 ), there is a vulnerability to a memory dos attack because there is no determination of whether the outpoints is duplicated.

PoC:

before send dos tx rss:
105700

after rss:
2306932

DoS cost: 25.6 KB * 150 + dep_tx out_points capacity ( 36 * 150 * 100 = 540000 ) = 4380000 CKB
Send 50 dos_tx, memory exhausted: (25.6 KB * 150 * 100) * 50 = 19.2 GB

Permalink: https://github.com/advisories/GHSA-j35p-q24r-5367
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qMzVwLXEyNHItNTM2N80_ng
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 2 years ago
Updated: over 1 year ago

Identifiers: GHSA-j35p-q24r-5367
References:

• https://github.com/nervosnetwork/ckb/security/advisories/GHSA-j35p-q24r-5367
• https://github.com/nervosnetwork/ckb/blob/v0.42.0/util/types/src/core/cell.rs#L600-L617
• https://github.com/advisories/GHSA-j35p-q24r-5367

Repository: https://github.com/nervosnetwork/ckb
Blast Radius: 1.0

Affected Packages