CVE-2018-12018
HIGHGo Ethereum < 1.8.11 - Denial of Service via LES GetBlockHeadersMsg Integer Signedness Error
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2018-12018. PoCs published by k3v142.
AI-analyzed exploit summary This PoC exploits CVE-2018-12018, a DoS vulnerability in Go Ethereum (geth) due to an integer signedness error in the LES protocol's GetBlockHeadersMsg handler. It sends a malformed packet with a -1 query.Skip value to crash the target node.
Description
The GetBlockHeadersMsg handler in the LES protocol implementation in Go Ethereum (aka geth) before 1.8.11 may lead to an access violation because of an integer signedness error for the array index, which allows attackers to launch a Denial of Service attack by sending a packet with a -1 query.Skip value. The vulnerable remote node would be crashed by such an attack immediately, aka the EPoD (Ethereum Packet of Death) issue.
Exploits (1)
This PoC exploits CVE-2018-12018, a DoS vulnerability in Go Ethereum (geth) due to an integer signedness error in the LES protocol's GetBlockHeadersMsg handler. It sends a malformed packet with a -1 query.Skip value to crash the target node.
References (4)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H