SB2020112446 - Multiple vulnerabilities in go-ethereum

Description

This security bulletin contains information about 2 vulnerabilities.

1) Input validation error (CVE-ID: CVE-2020-28362)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in a number of math/big.Int methods (Div, Exp, DivMod, Quo, Rem, QuoRem, Mod, ModInverse, ModSqrt, Jacobi, and GCD). A remote attacker can pass large input data to the application, specifically as divisor or modulo argument larger than 3168 bits (on 32-bit architectures) or 6336 bits (on 64-bit architectures).

2) Incorrect calculation (CVE-ID: CVE-2020-26240)

The vulnerability allows a local user to cause miners to create invalid proof-of-work.

The vulnerability exists due to incorrect DAG generation logic in the ethash mining DAG generation functionality when generating DAG data for an upcoming epoch. A local user can trigger mining with the erroneous DAG to cause miners to create invalid proof-of-work.

Only mining nodes are affected; non-mining nodes are unaffected.

Remediation

Install update from vendor's website.

References

• https://github.com/ethereum/go-ethereum/security/advisories/GHSA-m6gx-rhvj-fh52
• https://github.com/ethereum/go-ethereum/security/advisories/GHSA-v592-xf75-856p
• https://blog.ethereum.org/2020/11/12/geth_security_release/