Vulnerabilities > CVE-2023-40583 - Unspecified vulnerability in Protocol Libp2P

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

protocol

NVD

Published: 2023-08-25

Updated: 2024-11-21

Summary

libp2p is a networking stack and library modularized out of The IPFS Project, and bundled separately for other tools to use. In go-libp2p, by using signed peer records a malicious actor can store an arbitrary amount of data in a remote node’s memory. This memory does not get garbage collected and so the victim can run out of memory and crash. If users of go-libp2p in production are not monitoring memory consumption over time, it could be a silent attack i.e. the attacker could bring down nodes over a period of time (how long depends on the node resources i.e. a go-libp2p node on a virtual server with 4 gb of memory takes about 90 sec to bring down; on a larger server, it might take a bit longer.) This issue was patched in version 0.27.4.

Vulnerable Configurations

Part	Description	Count
Application	Protocol Protocol Libp2P - Protocol Libp2P 0.0.1 Protocol Libp2P 0.0.2 Protocol Libp2P 0.0.3 Protocol Libp2P 0.0.4 Protocol Libp2P 0.0.5 Protocol Libp2P 0.0.6 Protocol Libp2P 0.0.7 Protocol Libp2P 0.0.8 Protocol Libp2P 0.0.9 Protocol Libp2P 0.0.10 Protocol Libp2P 0.0.11 Protocol Libp2P 0.0.12 Protocol Libp2P 0.0.13 Protocol Libp2P 0.0.14 Protocol Libp2P 0.0.15 Protocol Libp2P 0.0.16 Protocol Libp2P 0.0.17 Protocol Libp2P 0.0.18 Protocol Libp2P 0.0.19 Protocol Libp2P 0.0.20 Protocol Libp2P 0.0.21 Protocol Libp2P 0.0.22 Protocol Libp2P 0.0.23 Protocol Libp2P 0.0.24 Protocol Libp2P 0.0.25 Protocol Libp2P 0.0.26 Protocol Libp2P 0.0.27 Protocol Libp2P 0.0.28 Protocol Libp2P 0.0.29 Protocol Libp2P 0.0.30 Protocol Libp2P 0.0.31 Protocol Libp2P 0.0.32 Protocol Libp2P 0.1.0 Protocol Libp2P 0.1.1 Protocol Libp2P 0.1.2 Protocol Libp2P 0.2.0 Protocol Libp2P 0.2.1 Protocol Libp2P 0.3.0 Protocol Libp2P 0.3.1 Protocol Libp2P 0.4.0 Protocol Libp2P 0.4.1 Protocol Libp2P 0.4.2 Protocol Libp2P 0.5.0 Protocol Libp2P 0.5.1 Protocol Libp2P 0.5.2 Protocol Libp2P 0.6.0 Protocol Libp2P 0.6.1 Protocol Libp2P 0.7.0 Protocol Libp2P 0.7.1 Protocol Libp2P 0.7.2 Protocol Libp2P 0.7.3 Protocol Libp2P 0.7.4 Protocol Libp2P 0.8.0 Protocol Libp2P 0.8.1 Protocol Libp2P 0.8.2 Protocol Libp2P 0.8.3 Protocol Libp2P 0.9.0 Protocol Libp2P 0.9.1 Protocol Libp2P 0.9.2 Protocol Libp2P 0.9.3 Protocol Libp2P 0.9.4 Protocol Libp2P 0.9.5 Protocol Libp2P 0.9.6 Protocol Libp2P 0.10.0 Protocol Libp2P 0.10.1 Protocol Libp2P 0.10.2 Protocol Libp2P 0.10.3 Protocol Libp2P 0.11.0 Protocol Libp2P 0.12.0 Protocol Libp2P 0.13.0 Protocol Libp2P 0.14.0 Protocol Libp2P 0.14.1 Protocol Libp2P 0.14.2 Protocol Libp2P 0.14.3 Protocol Libp2P 0.14.4 Protocol Libp2P 0.15.0 Protocol Libp2P 0.15.1 Protocol Libp2P 0.16.0 Protocol Libp2P 0.17.0 Protocol Libp2P 0.18.0 Protocol Libp2P 0.18.1 Protocol Libp2P 0.19.0 Protocol Libp2P 0.19.1 Protocol Libp2P 0.19.2 Protocol Libp2P 0.19.3 Protocol Libp2P 0.19.4 Protocol Libp2P 0.20.0 Protocol Libp2P 0.20.1 Protocol Libp2P 0.20.2 Protocol Libp2P 0.20.3 Protocol Libp2P 0.21.0 Protocol Libp2P 0.22.0 Protocol Libp2P 0.23.0 Protocol Libp2P 0.23.1 Protocol Libp2P 0.23.2 Protocol Libp2P 0.23.3 Protocol Libp2P 0.23.4 Protocol Libp2P 0.24.0 Protocol Libp2P 0.24.1 Protocol Libp2P 0.24.2 Protocol Libp2P 0.25.0 Protocol Libp2P 0.25.1 Protocol Libp2P 0.26.0 Protocol Libp2P 0.26.1 Protocol Libp2P 0.26.2 Protocol Libp2P 0.26.3 Protocol Libp2P 0.26.4 Protocol Libp2P 0.27.0 Protocol Libp2P 0.27.1 Protocol Libp2P 0.27.2 Protocol Libp2P 0.27.3	122

Summary

Vulnerable Configurations

References