Description
libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arithmetic overflow. A malicious rendezvous server can send a discovery response with an unbounded TTL value that causes the client node process to panic when computing the expiry timer.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
libp2p libp2p-rendezvous
Default version status: unaffected
0 to ≤ 0.17.1affected
pkg:cargo/libp2p-rendezvousReferences
- https://gist.github.com/thesmartshadow/25ef03f7ebbd12118a9d27695c885989 ↗
- https://docs.rs/crate/libp2p-rendezvous/0.17.1/source/src/client.rs ↗
- https://github.com/libp2p/rust-libp2p ↗
- https://www.vulncheck.com/advisories/libp2p-rendezvous-through-0.17.1-denial-of-service-via-unbounded-registration-ttl-in-discovery-responses ↗