Executive brief
Lodestar is an Ethereum consensus client used to validate blockchain data and participate in the network. The vulnerability allows an attacker to send specially crafted network messages that Lodestar cannot decompress, while other clients handle them correctly. This could cause Lodestar nodes to fall out of sync or stall, leading to a network partition affecting 25% or more of the network.
Technical details
The Ethereum Req/Resp protocol requires all clients to support ssz_snappy encoding (SSZ-encoded messages compressed with snappy framing). The snappy format defines reserved skippable chunk types in the range 0x80–0xFD that conformant decoders must silently skip; Rust and Go snappy implementations handle these correctly. Lodestar's TypeScript decompression function in `snappyFrames/uncompress.ts` uses a switch statement that lacks a case for skippable chunks, causing `getChunkType()` to throw an exception when encountering any chunk type outside {0xff, 0x00, 0x01, 0xfe}. An attacker or faulty node can craft a valid snappy-framed message containing a skippable chunk to trigger decoding failure on Lodestar nodes while other clients process it normally. This leads to chain stall and network partitioning. The fix (merged commit 18a0d68) adds a SKIPPABLE chunk type case and CRC32 validation to properly handle these reserved chunks.
Affected products
- ChainSafe @lodestar/reqresp < 1.25.0
Timeline
- 2025-01-14: disclosed: GHSA-53rv-hcvm-rpp9 published
- 2025-01-08: patched: Fix committed (18a0d68) prior to disclosure; patch released in version 1.25.0