mx-chain-go up to 1.4.15 Cross-Shard Miniblock Processing denial of service

Summaryinfo

A vulnerability was found in mx-chain-go up to 1.4.15. It has been declared as problematic. This impacts an unknown function of the component Cross-Shard Miniblock Processing. Executing a manipulation can lead to denial of service. The identification of this vulnerability is CVE-2023-33964. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in mx-chain-go up to 1.4.15 and classified as critical. This vulnerability affects some unknown processing of the component Cross-Shard Miniblock Processing. The manipulation with an unknown input leads to a denial of service vulnerability. The CWE definition for the vulnerability is CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. As an impact it is known to affect integrity, and availability. CVE summarizes:

mx-chain-go is an implementation of the MultiversX blockchain protocol written in the Go language. Metachain cannot process a cross-shard miniblock. Prior to version 1.4.16, an invalid transaction with the wrong username on metachain is not treated correctly on the metachain transaction processor. This is strictly a processing issue that could have happened on MultiversX chain. If an error like this had occurred, the metachain would have stopped notarizing blocks from the shard chains. The resuming of notarization is possible only after applying a patched binary version. A patch in version 1.4.16 introduces `processIfTxErrorCrossShard` for the metachain transaction processor. There are no known workarounds for this issue.

The weakness was shared 06/01/2023 as GHSA-7xpv-4pm9-xch2. The advisory is shared for download at github.com. This vulnerability was named CVE-2023-33964 since 05/24/2023. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading to version 1.4.16 eliminates this vulnerability. Applying the patch 97295471465f4b5f79e51b32f8b7111f8d921606 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• mx-chain-go

Version

• 1.4.0
• 1.4.1
• 1.4.2
• 1.4.3
• 1.4.4
• 1.4.5
• 1.4.6
• 1.4.7
• 1.4.8
• 1.4.9
• 1.4.10
• 1.4.11
• 1.4.12
• 1.4.13
• 1.4.14
• 1.4.15

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion