CVE-2018-20421: High severity ethereum blockchain vulnerability

Published Dec 24, 2018

Updated

Go Ethereum (aka geth) 1.8.19 allows attackers to cause a denial of service (memory consumption) by rewriting the length of a dynamic array in memory, and then writing data to a single memory location with a large index number, as demonstrated by use of "assembly { mstore }" followed by a "c[0xC800000] = 0xFF" assignment.

Affected Software

1 affected component

Ethereum Go Ethereum=1.8.19

Event History

Dec 24, 2018

CVE Published

via MITRE·03:00 AM

Data Sourced

via MITRE·03:00 AM

Description

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2018-20421.

What software version is affected by this vulnerability?

The software version affected by this vulnerability is Go Ethereum (aka geth) 1.8.19.

What is the severity rating of this vulnerability?

The severity rating of this vulnerability is high with a score of 7.5.

How can attackers exploit this vulnerability?

Attackers can exploit this vulnerability by rewriting the length of a dynamic array in memory and then writing data to a single memory location with a large index number.

Is there a fix available for this vulnerability?

Yes, a fix is available for this vulnerability and can be found in the reference link.