CVE-2024-52914
📋 TL;DR
This vulnerability allows an attacker to stall Bitcoin Core nodes for hours by sending a specially crafted unconfirmed transaction that creates orphan transactions. This affects anyone running vulnerable Bitcoin Core nodes, potentially disrupting network operations and node availability.
💻 Affected Systems
- Bitcoin Core
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete node unavailability for hours, disrupting transaction processing and network participation
Likely Case
Temporary node stalling causing delayed transaction processing and synchronization issues
If Mitigated
Minimal impact with proper monitoring and quick restart capabilities
🎯 Exploit Status
Exploitation requires sending a crafted transaction to vulnerable nodes, which is straightforward for attackers with Bitcoin transaction creation knowledge
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Bitcoin Core 0.18.0 and later
Vendor Advisory: https://bitcoincore.org/en/2024/07/03/disclose-orphan-dos/
Restart Required: Yes
Instructions:
1. Download Bitcoin Core 0.18.0 or later from bitcoincore.org. 2. Stop the Bitcoin Core service. 3. Install the new version. 4. Restart the Bitcoin Core service.
🔧 Temporary Workarounds
Limit incoming connections
allReduce exposure by limiting the number of incoming peer connections
bitcoind -maxconnections=8
Use only outbound connections
allConfigure node to only make outbound connections, not accept incoming
bitcoind -listen=0
🧯 If You Can't Patch
- Implement aggressive monitoring for node stalling and automated restart procedures
- Deploy network-level filtering to block suspicious transaction patterns
🔍 How to Verify
Check if Vulnerable:
Check Bitcoin Core version: if version is below 0.18.0, the system is vulnerableCheck Version:
bitcoind --versionVerify Fix Applied:
Verify Bitcoin Core version is 0.18.0 or higher and monitor node for normal operation📡 Detection & Monitoring
Log Indicators:
- Extended periods of orphan transaction processing
- Node becoming unresponsive for hours
- High CPU usage with orphan handling
Network Indicators:
- Unusual transaction patterns from single sources
- Multiple orphan transactions appearing simultaneously
SIEM Query:
bitcoin_core_logs: "orphan" AND duration > 3600