19 results · Feed
-
Medium —
Nervos CKB Permit load cell data from memory
### Impact The faulty nodes will reject transactions which calls `load_cell_data` syscall but the input cell is still in the mempool. They also ban other nodes and cause the network separation. ### Patches 0.35.2, 0.36.1, 0.37.1, 0.38.2
-
Medium —
Nervos CKB Pool does not remove the conflicting transactions from the statistics
### Impact There's a bug in the pool statistics that when conflicting transactions are removed from the pool, they are not subtracted from the statics. Finally, the transaction pool keeps full and reject all transactions. ### Patches 0.39.2 ### Workarounds Re…
-
Critical —
Nervos CKB Transaction which calls syscall load_cell_data_hash has nondeterministic result
### Impact Tx-pool verify transaction which inputs' script contains `load_cell_data_hash` is nondeterministic ### Workarounds Enforce tx-pool ResolvedTrascation inputs' load data is none.
-
High —
Nervos CKB Snappy decompress length can be very large and causes out of memory error
### Impact Adversary can create message which compressed size is less than the package limit but the decompressed length is very large such as 1G. It will cost the node many memories to process the network messages, and on the system with less than 1G memory,…
-
High —
Nervos CKB Panic on malformed input
### Impact CKB process will panic when received malformed p2p message because of snappy, which is used to compress network messages ### References https://github.com/BurntSushi/rust-snappy/issues/29
-
High —
Nervos CKB node panics when processing a block which parent timestamp is too new
### Impact Adversary can initiate DOS attack by broadcasting two consecutive blocks with timestamps in the future. ### Patches Please upgrade to v0.34.1
-
Medium —
Nervos CKB BlockTimeTooNew should not be considered as invalid block
### Impact Currently, when a node receives a block in future according to its local wall clock, it will mark the block as invalid and ban the peer. If the header's timestamp is more than 15 seconds ahead of our current time. In that case, the header may becom…
-
Low —
Nervos CKB DoS: Process exists when p2p discovery protocol receives unsupported peer IP
The p2p discovery protocol assumes that the peer IP must be valid IPv4 address.
-
Critical —
Nervos CKB P2P DoS Attacks
The P2P protocols lack of rate limit. For example, in relay protocol, when a node receives a broadcasted `tx_hashes`, it will mark it in memory to avoid duplicated requests. [code → ](https://github.com/nervosnetwork/ckb/blob/26e4837212c392c3c706a0da7a056131f…
-
Medium —
Nervos CKB Unaligned Pointer Dereference
via bounty@nervos.org There are multiple type conversions in ckb that unsafely cast between byte pointers and other types of pointers. This results in unaligned pointers, which are not allowed by the Rust language, and are considered undefined behavior, meani…
-
Low —
Nervos CKB vulnerable to low-resource flood DDoS attacks through network message
### Workarounds * forbid request genesis through network request * forbid requesting duplicate data through network request
-
Low —
Nervos CKB calculation of program load cycles may be missed when executing in resume mode
### Impact The calculation of program load cycles may be missed when executing in resume mode. Since the script execution order is now determined, this issue does not cause network splitting.
-
High —
ckb type_id script resume may randomly fail
### Impact https://github.com/nervosnetwork/ckb/blob/v0.101.2/script/src/verify.rs#L871-L879 TypeIdSystemScript resume handle is not correct when max_cycles is not enough, `ScriptError::ExceededMaximumCycles` will be raised directly ranther than suspend as ex…
-
Critical —
ckb: Transaction header_deps validation issue (network forking)
### Impact fn `HeaderChecker#check_valid` skipped main chain checking after this PR: https://github.com/nervosnetwork/ckb/pull/1646/files#diff-c4e017b67c1b3005ca0c446a9b0879571aa36a858b1f7ddd1b9328a884e3214bR171-R176 It will cause network forking if one trans…
-
Medium —
ckb: Large dep group requires a lot of resources to process but the cost to commit the transaction is very low.
### Impact When a transaction contains a dep group with many cells, the resources required to process it are not linear to the transaction size nor spent script cycles. ### Patches In 0.43.3, nodes drop the transactions relayed to them when they contain a dep…
-
High —
Dep Group Remote Memory Exhaustion (Denial of Service) in ckb
### Impact A remote attacker could exploit this vulnerability to exhaust ckb process memory of an affected node. ### Patches Upgrade to 0.43.1 or later. ### References After resolving the outpoints of one dep group, we put the corresponding content into a vec…
-
Critical 9.8
RPC call failure in ckb
An issue was discovered in the ckb crate before 0.40.0 for Rust. A get_block_template RPC call may fail in situations where it is supposed to select a Nervos CKB blockchain transaction with a higher fee rate than another transaction.
-
High 7.5
Allocation of Resources Without Limits or Throttling in ckb
An issue was discovered in the ckb crate before 0.40.0 for Rust. Remote attackers may be able to conduct a 51% attack against the Nervos CKB blockchain by triggering an inability to allocate memory for the misbehavior HashMap.
-
High 7.5
Process crashes when the cell used as DepGroup is not alive
An issue was discovered in the ckb crate before 0.40.0 for Rust. Attackers can cause a denial of service (Nervos CKB blockchain node crash) via a dead call that is used as a DepGroup.