CVE-2018-12018

CVE-2018-12018 Mitre https://vulners.com/cve/CVE-2018-12018 Go Ethereum（別名geth）1.8.11以前のLESプロトコル実装におけるGetBlockHeadersMsgハンドラは、配列インデックスの整数符号エラーによりアクセス違反を引き起こす可能性があります。これにより、攻撃者はクエリのSkip値に-1を指定したパケットを送信してサービス拒否攻撃を仕掛けることができます。脆弱なリモートノードはこのような攻撃により即座にクラッシュします。これはEPoD（Ethereum Packet of...

GHSA-P5GC-957X-GFW9 Go Ethereum LES protocol implementation vulnerable to Denial of Service

The GetBlockHeadersMsg handler in the LES protocol implementation in Go Ethereum aka geth before 1.8.11 may lead to an access violation because of an integer signedness error for the array index, which allows attackers to launch a Denial of Service attack by sending a packet with a -1 query.Skip...

Integer overflow

The GetBlockHeadersMsg handler in the LES protocol implementation in Go Ethereum aka geth before 1.8.11 may lead to an access violation because of an integer signedness error for the array index, which allows attackers to launch a Denial of Service attack by sending a packet with a -1 query.Skip...

CVE-2018-12018

CVE-2018-12018 affects Go Ethereum (geth) LES GetBlockHeadersMsg handling prior to v1.8.11. An integer signedness error for the array index allows a crafted query with Skip = -1 to crash a remote node (EPoD). The vulnerability occurs when the server validates the requested headers after skipping ...