CVE-2020-26241Medium· 6.5▾ SunlitShallow copy bug in geth
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
1.1%
1.1% → 1.2%
This is a Consensus vulnerability, which can be used to cause a chain-split where vulnerable nodes reject the canonical chain.
Geth’s pre-compiled dataCopy (at 0x00...04) contract did a shallow copy on invocation. An attacker could deploy a contract that
X to an EVM memory region R,0x00..04 with R as an argument,R to Y,RETURNDATACOPY opcode.When this contract is invoked, a consensus-compliant node would push X on the EVM stack, whereas Geth would push Y.
No standalone patches have been made.
Upgrade to 1.9.17 or higher.
https://blog.ethereum.org/2020/11/12/geth_security_release/
If you have any questions or comments about this advisory:
github.com/ethereum/go-ethereum >= 1.9.7, < 1.9.17Upgrade to a patched release:
github.com/ethereum/go-ethereum 1.9.17Connected by shared product, vendor, weakness, or advisory.
CVE-2020-26242Medium· 6.5Denial of service in geth
CVE-2021-39137Medium· 6.5Ethereum Contains Consensus Flaw During Block Processing
CVE-2021-41173Medium· 5.7Geth Node Vulnerable to DoS via maliciously crafted p2p message
CVE-2022-23328High· 7.5A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account that all fully spend the full balance of the account to a victim Geth node, which can purge all o…
CVE-2022-23327High· 7.5A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a high gas price in one message, which can purge all of pending transactions in a victim node's memory pool, causing a …