From 8b267f811ba753be9893abda8a3fed9a8f68ced7 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 3 Feb 2025 15:56:39 +0000 Subject: [PATCH] Publish GHSA-22qq-3xwm-r5x4 --- .../GHSA-22qq-3xwm-r5x4.json | 84 +++++++++++++++++++ 1 file changed, 84 insertions(+) create mode 100644 advisories/github-reviewed/2025/02/GHSA-22qq-3xwm-r5x4/GHSA-22qq-3xwm-r5x4.json diff --git a/advisories/github-reviewed/2025/02/GHSA-22qq-3xwm-r5x4/GHSA-22qq-3xwm-r5x4.json b/advisories/github-reviewed/2025/02/GHSA-22qq-3xwm-r5x4/GHSA-22qq-3xwm-r5x4.json new file mode 100644 index 00000000000..8af5b4556cb --- /dev/null +++ b/advisories/github-reviewed/2025/02/GHSA-22qq-3xwm-r5x4/GHSA-22qq-3xwm-r5x4.json @@ -0,0 +1,84 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-22qq-3xwm-r5x4", + "modified": "2025-02-03T15:55:28Z", + "published": "2025-02-03T15:55:28Z", + "aliases": [ + "CVE-2025-24371" + ], + "summary": "CometBFT allows a malicious peer to make node stuck in blocksync", + "details": "Name: ASA-2025-001: Malicious peer can disrupt node's ability to sync via blocksync\nComponent: CometBFT\nCriticality: Medium (Considerable Impact; Possible Likelihood per [ACMv1.2](https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md))\nAffected versions: <= v0.38.16, v1.0.0\nAffected users: Validators, Full nodes\n\n### Impact\n\nA malicious peer may be able to interfere with a node's ability to sync blocks with peers via the blocksync mechanism. \n\nIn the `blocksync` protocol peers send their `base` and `latest` heights when they connect to a new node (`A`), which is syncing to the tip of a network. `base` acts as a lower ground and informs `A` that the peer only has blocks starting from height `base`. `latest` height informs `A` about the latest block in a network. Normally, nodes would only report increasing heights:\n\n```\nB: {base: 100, latest: 1000}\nB: {base: 100, latest: 1001}\nB: {base: 100, latest: 1002}\n...\n```\n\nIf `B` fails to provide the latest block, `B` is removed and the `latest` height (target height) is recalculated based on other nodes `latest` heights.\n\nThe existing code hovewer doesn't check for the case where `B` first reports `latest` height `X` and immediately after height `Y`, where `X > Y`. For example:\n\n```\nB: {base: 100, latest: 2000}\nB: {base: 100, latest: 1001}\nB: {base: 100, latest: 1002}\n...\n```\n\n`A` will be trying to catch up to 2000 indefinitely. Even if `B` disconnects, the `latest` height (target height) won't be recalculated because `A` \"doesn't know where 2000\" came from per see.\n\n#### Impact Qualification\n\nThis condition requires the introduction of malicious code in the full node first reporting a non-existing `latest` height, then reporting lower `latest` height and nodes which are syncing using `blocksync` protocol.\n\n### Patches\n\nThe new CometBFT releases [v1.0.1](https://github.com/cometbft/cometbft/releases/tag/v1.0.1) and [v0.38.17](https://github.com/cometbft/cometbft/releases/tag/v0.38.17) fix this issue.\n\nUnreleased code in the main is patched as well.\n\n### Workarounds\n\nWhen the operator notices `blocksync` is stuck, they can identify the peer from which that message with \"invalid\" height was received. This may require increasing the logging level of the `blocksync` module. This peer can then be subsequently banned at the p2p layer as a temporary mitigation.\n\n### References\n\nIf you have questions about Interchain security efforts, please reach out to our official communication channel at [security@interchain.io](mailto:security@interchain.io). For more information about the Interchain Foundation’s engagement with Amulet, and to sign up for security notification emails, please see https://github.com/interchainio/security. \n\nA Github Security Advisory for this issue is available in the CometBFT [repository](https://github.com/cometbft/cometbft/security/advisories/GHSA-22qq-3xwm-r5x4). For more information about CometBFT, see https://docs.cometbft.com/.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/cometbft/cometbft" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.0.0-alpha.1" + }, + { + "fixed": "1.0.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/cometbft/cometbft" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.38.17" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/cometbft/cometbft/security/advisories/GHSA-22qq-3xwm-r5x4" + }, + { + "type": "WEB", + "url": "https://github.com/cometbft/cometbft/commit/0ee80cd609c7ae9fe856bdd1c6d38553fdae90ce" + }, + { + "type": "WEB", + "url": "https://github.com/cometbft/cometbft/commit/2cebfde06ae5073c0b296a9d2ca6ab4b95397ea5" + }, + { + "type": "PACKAGE", + "url": "https://github.com/cometbft/cometbft" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-703" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-02-03T15:55:28Z", + "nvd_published_at": null + } +} \ No newline at end of file