CVE-2021-35041
📋 TL;DR
This vulnerability in FISCO-BCOS blockchain nodes allows malicious nodes to send malformed packets that cause memory exhaustion and crashes. It affects FISCO-BCOS V2.7.2 deployments where nodes communicate with potentially untrusted peers. The bug enables denial-of-service attacks against blockchain network participants.
💻 Affected Systems
- FISCO-BCOS
📦 What is this software?
Fisco Bcos by Fisco Bcos
⚠️ Risk & Real-World Impact
Worst Case
Complete node crash leading to blockchain network partition, transaction processing disruption, and potential consensus failures across the network.
Likely Case
Individual node crashes requiring manual restart, causing temporary unavailability and potential transaction delays for affected nodes.
If Mitigated
Minimal impact with proper network segmentation and monitoring allowing quick detection and recovery from crashes.
🎯 Exploit Status
Exploitation requires network access to target node but no authentication. The attack is simple to implement as it involves sending malformed packets.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V2.7.3 or later
Vendor Advisory: https://github.com/FISCO-BCOS/FISCO-BCOS/issues/1951
Restart Required: Yes
Instructions:
1. Backup node configuration and data. 2. Stop the FISCO-BCOS node. 3. Upgrade to V2.7.3 or later. 4. Restart the node with updated binary.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict node-to-node communication to trusted peers only using firewall rules.
iptables -A INPUT -p tcp --dport [node_port] -s [trusted_peer_ip] -j ACCEPT
iptables -A INPUT -p tcp --dport [node_port] -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit node communication to trusted peers only.
- Deploy monitoring to detect abnormal memory consumption patterns and restart nodes automatically.
🔍 How to Verify
Check if Vulnerable:
Check FISCO-BCOS version: if running V2.7.2, the system is vulnerable.Check Version:
./fisco-bcos --versionVerify Fix Applied:
Verify version is V2.7.3 or later and test with packet fuzzing tools to ensure no crashes occur.📡 Detection & Monitoring
Log Indicators:
- Memory exhaustion warnings
- Node crash logs
- Failed packet decoding errors
Network Indicators:
- High volume of malformed packets from single source
- Abnormal packet size patterns
SIEM Query:
source="fisco-bcos.log" AND ("memory" OR "crash" OR "decode error")