CVE-2024-52917: Medium severity bitcoin vulnerability
Published Nov 18, 2024
·Updated
Bitcoin Core before 22.0 has a miniupnp infinite loop in which it allocates memory on the basis of random data received over the network, e.g., large M-SEARCH replies from a fake UPnP device.
Affected Software
2 affected components
Bitcoin Core<22.0
Bitcoin Bitcoin Core<22.0
Event History
Nov 18, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·04:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-52917?
CVE-2024-52917 is classified as high severity due to its potential to cause an infinite loop and memory exhaustion.
2
How do I fix CVE-2024-52917?
To mitigate CVE-2024-52917, upgrade to Bitcoin Core version 22.0 or later.
3
What causes the vulnerability in CVE-2024-52917?
CVE-2024-52917 is caused by an infinite loop in miniupnp that allocates memory based on arbitrary data from the network.
4
Which versions of Bitcoin Core are affected by CVE-2024-52917?
CVE-2024-52917 affects all versions of Bitcoin Core prior to 22.0.
5
What kind of attacks can CVE-2024-52917 facilitate?
CVE-2024-52917 can facilitate Denial of Service (DoS) attacks by exhausting system memory through large UPnP M-SEARCH replies.