CVE-2020-26240: Erroneous Proof of Work calculation in geth
Impact An ethash mining DAG generation flaw in Geth could cause miners to erroneously calculate PoW in an upcoming epoch (estimated early January, 2021). This happened on the ETC chain on 2020-11-06. This issue is relevant only for miners, non-mining nodes are unaffected.
Patches This issue is also fixed as of 1.9.24. Thanks to @slavikus for bringing the issue to our attention and writing the fix.
Workarounds This PR implements a patch: https://github.com/ethereum/go-ethereum/pull/21793
References https://blog.ethereum.org/2020/11/12/gethsecurityrelease/
For more information If you have any questions or comments about this advisory: Open an issue in go-ethereum Email us at security@ethereum.org
Other sources
Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. An ethash mining DAG generation flaw in Geth before version 1.9.24 could cause miners to erroneously calculate PoW in an upcoming epoch (estimated early January, 2021). This happened on the ETC chain on 2020-11-06. This issue is relevant only for miners, non-mining nodes are unaffected. This issue is fixed as of 1.9.24
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2020-26240?
The severity of CVE-2020-26240 is high, with a severity value of 7.5.
How does CVE-2020-26240 impact miners?
CVE-2020-26240 can cause miners to erroneously calculate Proof of Work (PoW) in an upcoming epoch, potentially affecting the mining process.
Are non-mining nodes affected by CVE-2020-26240?
No, non-mining nodes are unaffected by CVE-2020-26240.
What is the recommended version to fix CVE-2020-26240?
To fix CVE-2020-26240, upgrade to version 1.9.24 of Go Ethereum (Geth).
Where can I find more information about CVE-2020-26240?
More information about CVE-2020-26240 can be found in the references section: [link1], [link2], [link3].