CVE-2018-12018

CVE-2018-12018 Mitre https://vulners.com/cve/CVE-2018-12018 Go以太坊（即geth）1.8.11之前版本中LES协议实现的GetBlockHeadersMsg处理器，由于数组索引的整数有符号性错误，可能导致访问违规，攻击者可通过发送包含-1 query.Skip值的数据包发起拒绝服务攻击。受影响的远程节点会因此立即崩溃，即EPoD（以太坊死亡数据包）问题。 主网 python3 exploit.py --mainnet --enode 'enode' 测试网 python3 exploit.py --enode 'enode'...

GHSA-P5GC-957X-GFW9 Go Ethereum LES protocol implementation vulnerable to Denial of Service

The GetBlockHeadersMsg handler in the LES protocol implementation in Go Ethereum aka geth before 1.8.11 may lead to an access violation because of an integer signedness error for the array index, which allows attackers to launch a Denial of Service attack by sending a packet with a -1 query.Skip...

Integer overflow

The GetBlockHeadersMsg handler in the LES protocol implementation in Go Ethereum aka geth before 1.8.11 may lead to an access violation because of an integer signedness error for the array index, which allows attackers to launch a Denial of Service attack by sending a packet with a -1 query.Skip...

CVE-2018-12018

CVE-2018-12018 affects Go Ethereum (geth) LES GetBlockHeadersMsg handling prior to v1.8.11. An integer signedness error for the array index allows a crafted query with Skip = -1 to crash a remote node (EPoD). The vulnerability occurs when the server validates the requested headers after skipping ...