CVE-2023-39533
📋 TL;DR
This vulnerability allows malicious peers to perform resource exhaustion attacks by sending large RSA keys during Noise handshake or x509 extension verification in go-libp2p. Affected systems include applications using vulnerable versions of go-libp2p for peer-to-peer networking, potentially leading to denial of service.
💻 Affected Systems
- go-libp2p
- applications using go-libp2p for networking
📦 What is this software?
Go Libp2p by Libp2p
Go Libp2p by Libp2p
Go Libp2p by Libp2p
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service through CPU exhaustion, rendering the node unresponsive and disrupting network connectivity.
Likely Case
Degraded performance and increased resource consumption during handshake processes with malicious peers.
If Mitigated
Minimal impact with proper patching and updated Go compiler versions preventing large RSA key processing.
🎯 Exploit Status
Attack requires sending specially crafted RSA keys during handshake, which is straightforward for malicious peers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: go-libp2p 0.27.8, 0.28.2, or 0.29.1
Vendor Advisory: https://github.com/libp2p/go-libp2p/security/advisories
Restart Required: Yes
Instructions:
1. Update go-libp2p to version 0.27.8, 0.28.2, or 0.29.1. 2. Update Go compiler to version 1.20.7 or 1.19.12. 3. Rebuild and redeploy application. 4. Restart all affected services.
🔧 Temporary Workarounds
No known workarounds
allThe vendor states there are no known workarounds for this vulnerability.
🧯 If You Can't Patch
- Implement network-level controls to limit connections from untrusted peers
- Monitor CPU usage and restart services if abnormal resource consumption is detected
🔍 How to Verify
Check if Vulnerable:
Check go.mod or vendor dependencies for go-libp2p versions below 0.27.8, 0.28.2, or 0.29.1Check Version:
go list -m github.com/libp2p/go-libp2pVerify Fix Applied:
Verify go-libp2p version is >=0.27.8, >=0.28.2, or >=0.29.1 and Go compiler is >=1.20.7 or >=1.19.12📡 Detection & Monitoring
Log Indicators:
- High CPU usage during handshake processes
- Failed handshake attempts with large key sizes
Network Indicators:
- Unusually large RSA key exchanges during Noise handshake
SIEM Query:
process.cpu.usage > 90% AND process.name contains 'libp2p' OR 'go'🔗 References
- https://github.com/golang/go/commit/2350afd2e8ab054390e284c95d5b089c142db017
- https://github.com/golang/go/issues/61460
- https://github.com/libp2p/go-libp2p/commit/0cce607219f3710addc7e18672cffd1f1d912fbb
- https://github.com/libp2p/go-libp2p/commit/445be526aea4ee0b1fa5388aa65d32b2816d3a00
- https://github.com/libp2p/go-libp2p/commit/e30fcf7dfd4715ed89a5e68d7a4f774d3b9aa92d
- https://github.com/libp2p/go-libp2p/pull/2454
- https://github.com/libp2p/go-libp2p/security/advisories/GHSA-876p-8259-xjgg
- https://github.com/quic-go/quic-go/pull/4012
- https://github.com/golang/go/commit/2350afd2e8ab054390e284c95d5b089c142db017
- https://github.com/golang/go/issues/61460
- https://github.com/libp2p/go-libp2p/commit/0cce607219f3710addc7e18672cffd1f1d912fbb
- https://github.com/libp2p/go-libp2p/commit/445be526aea4ee0b1fa5388aa65d32b2816d3a00
- https://github.com/libp2p/go-libp2p/commit/e30fcf7dfd4715ed89a5e68d7a4f774d3b9aa92d
- https://github.com/libp2p/go-libp2p/pull/2454
- https://github.com/libp2p/go-libp2p/security/advisories/GHSA-876p-8259-xjgg
- https://github.com/quic-go/quic-go/pull/4012
