CVE-2018-11548: Input Validation
An issue was discovered in EOS.IO DAWN 4.2. plugins/netplugin/netplugin.cpp does not limit the number of P2P connections from the same source IP address.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any remote attacker can attempt exploitation without authentication or user interaction. The affected component does not limit P2P connections originating from a single source IP address.
What is the practical impact of successful exploitation?
An attacker can open excessive P2P connections from one IP address, potentially exhausting available resources and causing a denial of service. The supplied CVSS vector indicates availability impact only, with no confidentiality or integrity impact.
How can I determine whether an instance is affected?
Instances running EOS.IO DAWN 4.2 should be considered affected if they use the net_plugin component and do not have an effective external or local limit on P2P connections per source IP address.
What can be done if updating is not immediately possible?
Apply connection-rate or concurrent-connection limits per source IP address using network controls in front of the P2P service, or otherwise restrict access to trusted peers. This reduces the ability of a single remote source to consume connections.