CVE-2018-12018: Out-of-bounds Read
The GetBlockHeadersMsg handler in the LES protocol implementation in Go Ethereum (aka geth) before 1.8.11 may lead to an access violation because of an integer signedness error for the array index, which allows attackers to launch a Denial of Service attack by sending a packet with a -1 query.Skip value. The vulnerable remote node would be crashed by such an attack immediately, aka the EPoD (Ethereum Packet of Death) issue.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-12018?
The severity of CVE-2018-12018 is high (7.5).
How does CVE-2018-12018 impact Go Ethereum (geth)?
CVE-2018-12018 may lead to an access violation in Go Ethereum (geth) before version 1.8.11, allowing attackers to launch a Denial of Service attack.
How can I fix CVE-2018-12018 in Go Ethereum (geth)?
To fix CVE-2018-12018, update Go Ethereum (geth) to version 1.8.11 or later.
What is the Common Weakness Enumeration (CWE) ID for CVE-2018-12018?
The CWE ID for CVE-2018-12018 is CWE-129.
Where can I find more information about CVE-2018-12018?
You can find more information about CVE-2018-12018 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2018-12018), [GitHub Pull Request](https://github.com/ethereum/go-ethereum/pull/16891), [GitHub Commit](https://github.com/ethereum/go-ethereum/commit/a5237a27eaf81946a3edb4fafe13ed6359d119e4).