Lucene search

K
osvGoogleOSV:GHSA-7XPV-4PM9-XCH2
HistoryJun 02, 2023 - 7:41 p.m.

mx-chain-go does not treat invalid transaction with wrong username correctly

2023-06-0219:41:31
Google
osv.dev
12
mx-chain-go
invalid transaction
metachain
processing issue
multiversx chain
notarization
patched binary
transaction processor

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

35.5%

Impact

Metachain cannot process a cross-shard miniblock.
An invalid transaction with the wrong username on metachain is not treated correctly on the metachain transaction processor. This is strictly a processing issue that could have happened on MultiversX chain. If an error like this had occurred, the metachain would have stopped notarizing blocks from the shard chains. The resuming of notarization is possible only after applying a patched binary version.

Patches

Introduce processIfTxErrorCrossShard for metachain transaction processor.

Workarounds

No

References

No

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

35.5%

Related for OSV:GHSA-7XPV-4PM9-XCH2