CVE-2020-26242Medium· 6.5▾ SunlitDenial of service in geth
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
1.5%
1.5% → 1.5%
Denial-of-service (crash) during block processing
Affected versions suffer from a vulnerability which can be exploited through the MULMOD operation, by specifying a modulo of 0: mulmod(a,b,0), causing a panic in the underlying library.
The crash was in the uint256 library, where a buffer underflowed.
if `d == 0`, `dLen` remains `0`
and https://github.com/holiman/uint256/blob/4ce82e695c10ddad57215bdbeafb68b8c5df2c30/uint256.go#L451 will try to access index [-1].
The uint256 library was first merged in this commit, on 2020-06-08.
Exploiting this vulnerabilty would cause all vulnerable nodes to drop off the network.
The issue was brought to our attention through a bug report, showing a panic occurring on sync from genesis on the Ropsten network.
It was estimated that the least obvious way to fix this would be to merge the fix into uint256, make a new release of that library and then update the geth-dependency.
Upgrade to v1.9.18 or higher
Not at this time
https://blog.ethereum.org/2020/11/12/geth_security_release/
If you have any questions or comments about this advisory:
github.com/ethereum/go-ethereum >= 1.9.16, < 1.9.18github.com/holiman/uint256 >= 0.1.0, < 1.1.1Upgrade to a patched release:
github.com/ethereum/go-ethereum 1.9.18github.com/holiman/uint256 1.1.1Connected by shared product, vendor, weakness, or advisory.
CVE-2020-26241Medium· 6.5Shallow copy bug in geth
CVE-2021-39137Medium· 6.5Ethereum Contains Consensus Flaw During Block Processing
CVE-2021-41173Medium· 5.7Geth Node Vulnerable to DoS via maliciously crafted p2p message
CVE-2022-23328High· 7.5A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account that all fully spend the full balance of the account to a victim Geth node, which can purge all o…
CVE-2022-23327High· 7.5A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a high gas price in one message, which can purge all of pending transactions in a victim node's memory pool, causing a …