Security Digest · Critical advisory (no CVE assigned)
GHSA-84x2-2qv6-qg56: Nervos CKB P2P DoS Attacks
The P2P protocols lack of rate limit. For example, in relay protocol, when a node receives a broadcasted txhashes, it will mark it in memory to avoid duplicated requests.
GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
cargo audit. - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| crates.io (Rust) | ckb | < 0.34.0 | 0.34.0 |
Details
The P2P protocols lack of rate limit. For example, in relay protocol, when a node receives a broadcasted txhashes, it will mark it in memory to avoid duplicated requests. code → .
It is easy to establish a DoS attach by generating random tx hashes.
Impact
It affects all nodes connected to the P2P network.
Workarounds
Apply rate limit on the data sent to CKB P2P port.
Sources and references
- GitHub Advisory GHSA-84x2-2qv6-qg56 github.com
- github.com github.com
- github.com github.com
Critical crates.io (Rust) advisories · Today’s Security Digest