GHSA-ppjg-v974-84cm
Go-Ethereum vulnerable to denial of service via malicious p2p message
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/ethereum/go-ethereum | < 1.12.1-stable | 1.12.1-stable |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
A vulnerable node, can be made to consume unbounded amounts of memory when handling specially crafted p2p messages sent from an attacker node.
### Details
The p2p handler spawned a new goroutine to respond to `ping` requests. By flooding a node with ping requests, an unbounded number of goroutines can be created, leading to resource exhaustion and potentially crash due to OOM.
### Patches
The fix is included in geth version `1.12.1-stable`, i.e, `1.12.2-unstable` and onwards.
Fixed by https://github.com/ethereum/go-ethereum/pull/27887
### Workarounds
No known workarounds.
### Credits
This bug was reported by Patrick McHardy and reported via [[email protected]](mailto:[email protected]).
### References
References
External links from the advisory. They lead to third-party sites.