Executive brief
bcoin is a Bitcoin library and node implementation for JavaScript. A vulnerability in the peer-to-peer network code allowed remote attackers to consume excessive memory without authentication, causing the application to crash or become unresponsive. This could disrupt Bitcoin node operations and network participation.
Technical details
The vulnerability is an uncontrolled memory resource consumption issue (CWE-400) in the peer-to-peer network code of bcoin. The flaw exploits the inventory message handling mechanism, allowing a remote, unauthenticated attacker to send specially crafted network messages that cause unbounded memory allocation. No special privileges or user interaction are required; the attack is triggered directly via the network interface. A successful exploit results in denial of service through memory exhaustion. The vulnerability was patched in bcoin version 1.0.2 and affected all versions up to and including v1.0.0-pre.
Affected products
- bcoin bcoin <= v1.0.0-pre
Timeline
- 2020-09-10: disclosed: Advisory published
- 2018: patched: Fix released in version 1.0.2