CVE-2023-40583

libp2p is a networking stack and library modularized out of The IPFS Project, and bundled separately for other tools to use. In go-libp2p, by using signed peer records a malicious actor can store an arbitrary amount of data in a remote node’s memory. This memory does not get garbage collected and so the victim can run out of memory and crash. If users of go-libp2p in production are not monitoring memory consumption over time, it could be a silent attack i.e. the attacker could bring down nodes over a period of time (how long depends on the node resources i.e. a go-libp2p node on a virtual server with 4 gb of memory takes about 90 sec to bring down; on a larger server, it might take a bit longer.) This issue was patched in version 0.27.4.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/libp2p/go-libp2p/commit/45d3c6fff662ddd6938982e7e9309ad5fa2ad8dd	Patch
https://github.com/libp2p/go-libp2p/releases/tag/v0.27.4	Release Notes
https://github.com/libp2p/go-libp2p/releases/tag/v0.27.7	Release Notes
https://github.com/libp2p/go-libp2p/security/advisories/GHSA-gcq9-qqwx-rgj3	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:protocol:libp2p:*:*:*:*:*:go:*:*

History

No history.

Information

Published : 2023-08-25 21:15

Updated : 2023-09-01 13:10

NVD link : CVE-2023-40583

Mitre link : CVE-2023-40583

CVE.ORG link : CVE-2023-40583

JSON object : View

Products Affected

protocol

libp2p

CWE

NVD-CWE-noinfo CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2023-40583", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2023-08-25T21:15:09.000", "references": [{"url": "https://github.com/libp2p/go-libp2p/commit/45d3c6fff662ddd6938982e7e9309ad5fa2ad8dd", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/libp2p/go-libp2p/releases/tag/v0.27.4", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/libp2p/go-libp2p/releases/tag/v0.27.7", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/libp2p/go-libp2p/security/advisories/GHSA-gcq9-qqwx-rgj3", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "libp2p is a networking stack and library modularized out of The IPFS Project, and bundled separately for other tools to use. In go-libp2p, by using signed peer records a malicious actor can store an arbitrary amount of data in a remote node\u2019s memory. This memory does not get garbage collected and so the victim can run out of memory and crash. If users of go-libp2p in production are not monitoring memory consumption over time, it could be a silent attack i.e. the attacker could bring down nodes over a period of time (how long depends on the node resources i.e. a go-libp2p node on a virtual server with 4 gb of memory takes about 90 sec to bring down; on a larger server, it might take a bit longer.) This issue was patched in version 0.27.4."}, {"lang": "es", "value": "libp2p es una pila de red y una biblioteca modularizada a partir del Proyecto IPFS, y empaquetada por separado para que otras herramientas puedan utilizarla. En go-libp2p, mediante el uso de registros de pares firmados, un actor malicioso puede almacenar una cantidad arbitraria de datos en la memoria de un nodo remoto. Esta memoria no se recoge de la basura, por lo que la v\u00edctima puede quedarse sin memoria y bloquearse. Si los usuarios de go-libp2p en producci\u00f3n no monitorizan el consumo de memoria a lo largo del tiempo, podr\u00eda tratarse de un ataque silencioso, es decir, el atacante podr\u00eda hacer caer nodos durante un periodo de tiempo (el tiempo depende de los recursos del nodo, es decir, un nodo go-libp2p en un servidor virtual con 4 gb de memoria tarda unos 90 segundos en caerse; en un servidor m\u00e1s grande, podr\u00eda tardar un poco m\u00e1s). Este problema fue corregido en la versi\u00f3n 0.27.4.\n"}], "lastModified": "2023-09-01T13:10:55.577", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:protocol:libp2p:*:*:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "C5F4582C-9B6B-41FB-99E1-C3B2CB0E19AD", "versionEndExcluding": "0.27.4"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}