CVE-2024-34360

2024-05-1415:38:45

CWE-754

[email protected]

web.nvd.nist.gov

go-spacemesh implementation

spacemesh protocol

atx publication

8.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

7.9 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.6%

JSON

go-spacemesh is a Go implementation of the Spacemesh protocol full node. Nodes can publish activations transactions (ATXs) which reference the incorrect previous ATX of the Smesher that created the ATX. ATXs are expected to form a single chain from the newest to the first ATX ever published by an identity. Allowing Smeshers to reference an earlier (but not the latest) ATX as previous breaks this protocol rule and can serve as an attack vector where Nodes are rewarded for holding their PoST data for less than one epoch but still being eligible for rewards. This vulnerability is fixed in go-spacemesh 1.5.2-hotfix1 and Spacemesh API 1.37.1.

Affected configurations

Vulners

Node

spacemeshosgo_spacemeshRange<1.5.2-hotfix1

CNA Affected

[
  {
    "vendor": "spacemeshos",
    "product": "go-spacemesh",
    "versions": [
      {
        "version": "< 1.5.2-hotfix1",
        "status": "affected"
      }
    ]
  }
]