Memory Consumption Vulnerability in Ethereum Implementation by Go-Ethereum
CVE-2024-32972

7.5HIGH

Key Information:

Vendor

Ethereum

Status
Go-ethereum
Vendor
CVE Published:
6 May 2024

What is CVE-2024-32972?

The go-ethereum implementation, also known as geth, is a critical execution layer for the Ethereum protocol. Prior to version 1.13.15, a vulnerability existed that allowed an attacker to send specially crafted peer-to-peer (p2p) messages to a vulnerable node, leading to excessive memory consumption. This severe flaw could destabilize the affected node, making it susceptible to denial-of-service attacks. The issue has been addressed and patched in version 1.13.15 and later. Users and administrators of go-ethereum are strongly encouraged to upgrade to the latest version to protect their nodes from potential exploits.

Affected Version(s)

go-ethereum < 1.13.15

References

https://github.com/ethereum/go-ethereum/security/advisori...
x_refsource_CONFIRM
https://github.com/ethereum/go-ethereum/compare/v1.13.14....
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2024-32972 : Memory Consumption Vulnerability in Ethereum Implementation by Go-Ethereum