CVE-2023-34458

2023-07-1319:15:09

Google

osv.dev

multiversx blockchain protocol

golang

dos attack

relayednoncefixenableepoch

strict processing

software

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

43.9%

JSON

mx-chain-go is the official implementation of the MultiversX blockchain protocol, written in golang. When executing a relayed transaction, if the inner transaction failed, it would have increased the inner transaction’s sender account nonce. This could have contributed to a limited DoS attack on a targeted account. The fix is a breaking change so a new flag RelayedNonceFixEnableEpoch was needed. This was a strict processing issue while validating blocks on a chain. This vulnerability has been patched in version 1.4.17.

References

github.com/multiversx/mx-chain-go/blob/babdb144f1316ab6176bf3dbd7d4621120414d43/integrationTests/vm/txsFee/relayedMoveBalance_test.go#LL165C14-L165C14

github.com/multiversx/mx-chain-go/commit/babdb144f1316ab6176bf3dbd7d4621120414d43

github.com/multiversx/mx-chain-go/releases/tag/v1.4.17

github.com/multiversx/mx-chain-go/security/advisories/GHSA-j494-7x2v-vvvp