Executive brief
ChainSafe's libp2p-noise is a cryptographic protocol library used to secure peer-to-peer network communications in blockchain and decentralized applications. A failure to properly validate digital signatures during the handshake process allows an attacker to impersonate legitimate peers and cause them to be incorrectly banned from the network, disrupting service availability and network integrity.
Technical details
The vulnerability is a signature validation bypass (CWE-347) in the Noise protocol handshake implementation. The library fails to correctly validate signatures during peer authentication, allowing a man-in-the-middle attacker to forge valid-looking handshakes without possessing the legitimate peer's private key. No authentication or special privileges are required—any network-reachable attacker can execute this attack. An attacker can impersonate other peers, potentially causing those peers to be banned from the network and disrupting P2P connectivity. Patches are available in versions 4.1.2 and 5.0.3; affected versions are all versions before 4.1.2 and versions 5.0.0 through 5.0.2.
Affected products
- ChainSafe libp2p-noise before 4.1.2 and 5.0.0 to 5.0.2
Timeline
- 2022-03-17: disclosed: Published by NVD
- 2022-03-18: patched: Versions 4.1.2 and 5.0.3 released