CVE-2024-32972 go-ethereum denial of service via malicious p2p message

2024-05-0614:26:19

CWE-400

GitHub_M

www.cve.org

cve-2024-32972

go-ethereum

denial of service

p2p message

vulnerability

fix

version 1.13.15

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.0004 Low

EPSS

Percentile

9.1%

JSON

go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to 1.13.15, a vulnerable node can be made to consume very large amounts of memory when handling specially crafted p2p messages sent from an attacker node. The fix has been included in geth version 1.13.15 and onwards.

CNA Affected

[
  {
    "vendor": "ethereum",
    "product": "go-ethereum",
    "versions": [
      {
        "version": "< 1.13.15",
        "status": "affected"
      }
    ]
  }
]