Ethereum Blog: Geth releases latest fix

Original title: "GETH released the latest repair version"

Original source: Ethereum Chinese Network

Summary

< p>

versions of geth  built with Go <1.15.5 or <1.14.12 are likely to be affected by a critical security vulnerability (DoS). The Golang team has registered this vulnerability as "CVE-2020-28362".

We recommend all users to use Go 1.15.5 or 1.14.12 to rebuild the client (preferably v1.9.24 version) to avoid node crash . Also, if you're running the official program, we released Geth v1.9.24 based on Go 1.15.5. (Release: https://github.com/ethereum/go-ethereum/releases/tag /v1.9.24)

Docker image is probably out of date due to lack of base image, see here for instructions to temporarily build image with Go1.15.5. Please run geth version to verify which version of Go your program is using.

Background

In early October, go-ethereum joined Google's OSS-Fuzz project. We performed fuzzing ad-hoc and tested a few different platforms.

On October 24th, one of the test tools found a crash.

After investigation, the root cause of the issue was found to be a bug in the Go standard library, and the issue has been reported.

 

Impact

During block processing, all Geth nodes can be crashed by exploiting the DoS vulnerability , the ensuing consequence is that most of the nodes in the Ethereum network are offline.

In addition to Go-Ethereum, this issue is likely to affect all Geth forks (such as TurboGeth or core-geth used by ETC). In order to expand the scope of the investigation, we will continue to backtrack the code, and the Go team has also launched an investigation on potentially affected users.

Event Timeline 

2020-10-24: Received from OSS-fuzz Crash report of 

2020-10-25: After investigation, it was found that the cause was a vulnerability in the Go language. The detailed report has been sent to security@golang.org

2020-10-26: Confirmation feedback received, continue to investigate  ;

2020-10-26 – 2020-11-06: Discuss possible fixes, continue to retrospectively investigate potentially affected users 

2020-11-06: Go Vulnerability fixes are tentatively scheduled to be released on November 12, 2020 

2020-11-09: Go pre-announced security patches: https://groups.google.com/g/golang-announce/c/kMa3eup0qhU/m/O5RSMHO_CAAJ

2020-11-11 : Via Geth's official twitter, Discord and Reddit notifies users 

2020-11-12 : Release a new Go version, and other issues in the new version of geth 

Mining Vulnerability

< p>This PR submits another security issue, brought to our attention, which contains a fix for the ethash algorithm.

This mining bug could cause miners to miscalculate proof-of-work in future epochs. The ETC chain already had this issue on 2020-11-06. It is expected that this may impact the ETH mainnet at block height 11550000 / epoch 385 in early January 2021.

This problem has also been fixed in the v1.9.24 version. This vulnerability is only related to miner nodes, and non-miner nodes are not affected.

Shallow copy vulnerability in Geth

Affected versions: 1.9.7 –  1.9.16

Fixed: 1.9.17

Type: Consensus Vulnerability

July 2020 On March 15th, John Youngseok Yang (Software Platform Lab) reported a consensus vulnerability in Geth.

Geth's precompiled dataCopy (0x00 ... 04) contract does a shallow copy when called, while Parity does a deep copy. An attacker can deploy such a contract:

Write X in EVM memory area R 

Use R as a parameter to call 0x00..04  ;

Use R  to override Y 

Finally call RETURNDATACOPY 

When the opcode calls the contract, Parity will push X in the EVM stack , and Geth will push Y 

result

This happened in the Ethereum mainnet zone Transaction at block height 11234873  0x57f7f9, which caused the node to go offline, and about 30 blocks were lost in the side chain. This also caused Infura to go offline, which in turn affected users and service providers using Infura.

See Geth and Infura's incident report, and this series of tweets.

DoS Vulnerability in Versions 16  and  .17 

Affected Versions : v1.9.16,v1.9.17

Fixed: v1.9.18

Type: DoS vulnerability during block processing

We found a DoS vulnerability and fixed it in v1.9.18. We have decided not to release details at this point in time.

Recommendation

In the short term, we recommend that all users upgrade Geth to v1.9.24 immediately Version (Go 1.15.5), here is the official Release: https://github .com/ethereum/go-ethereum/releases/tag/v1.9.24

If you are using Geth via Docker, there may be some question. In case of ethereum/client-go, two things to be aware of:

New images in Docker hub may be delayed

If Go's If the base image is not created so quickly, it is likely to be created based on a vulnerable version of Go

If you plan to create the docker image yourself (via the docker build .), you may also encounter the second problem.

So make sure the base image is using Go 1.15.5.

In the long run, we recommend users and miners to use alternative clients. We strongly recognize that for the Ethereum network to remain resilient, it cannot rely on a single client implementation. Other client options include Besu, Nethermind, OpenEthereum  and  TurboGeth  and so on.

You can pass https://bounty.ethereum.org

a>, bounty@ethereum.org  or security@ethereum.org  Report a security vulnerability.

Original link

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia