{"id":"GHSA-84x2-2qv6-qg56","summary":"Nervos CKB P2P DoS Attacks","details":"The P2P protocols lack of rate limit. For example, in relay protocol, when a node receives a broadcasted `tx_hashes`, it will mark it in memory to avoid duplicated requests. [code → ](https://github.com/nervosnetwork/ckb/blob/26e4837212c392c3c706a0da7a056131fb060433/sync/src/relayer/transactions_process.rs#L67).\n\nIt is easy to establish a DoS attach by generating random tx hashes.\n\n### Impact\n\nIt affects all nodes connected to the P2P network.\n\n### Workarounds\n\nApply rate limit on the data sent to CKB P2P port.","modified":"2024-02-02T22:21:27Z","published":"2024-02-02T22:21:27Z","database_specific":{"cwe_ids":[],"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2024-02-02T22:21:27Z","nvd_published_at":null},"references":[{"type":"WEB","url":"https://github.com/nervosnetwork/ckb/security/advisories/GHSA-84x2-2qv6-qg56"},{"type":"WEB","url":"https://github.com/nervosnetwork/ckb/commit/c5eb5478b635cea2ccef8676cf97692cd38293c3"}],"affected":[{"package":{"name":"ckb","ecosystem":"crates.io","purl":"pkg:cargo/ckb"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.34.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/02/GHSA-84x2-2qv6-qg56/GHSA-84x2-2qv6-qg56.json"}}],"schema_version":"1.9.0"}