Executive brief
IPFS Bitswap is a data exchange protocol library used in InterPlanetary File System implementations. Versions prior to 0.24.1 are vulnerable to a denial-of-service attack where malicious actors can force the library to store unwanted data blocks in its cache, exhausting disk space and system resources and degrading availability for legitimate users.
Technical details
The vulnerability is a resource exhaustion flaw (CWE-400) in ipfs-bitswap versions before 0.24.1. The root cause is that the library accepted and stored blocks in the blockstore without proper validation of whether those blocks were actually requested or wanted, allowing an attacker to inject arbitrary blocks into the local storage. The attack is network-reachable and requires no authentication or user interaction—an attacker can send crafted Bitswap messages over the network to trigger storage of unwanted blocks. By repeatedly sending unwanted blocks, an attacker exhausts disk space and memory, degrading service availability. The fix, released in version 0.24.1, implements filtering to ignore unwanted blocks before storing them.
Affected products
- IPFS Bitswap prior to 0.24.1
Timeline
- 2020-09-02: disclosed
- 2019-05-30: patched: Fix merged in PR #194