CVE-2024-52916
📋 TL;DR
Bitcoin Core versions before 0.15.0 are vulnerable to a denial-of-service attack where an attacker can flood the node with minimum difficulty headers, causing excessive memory consumption that leads to the daemon process being killed by the operating system's out-of-memory (OOM) killer. This affects anyone running vulnerable Bitcoin Core nodes, particularly those exposed to the Bitcoin peer-to-peer network.
💻 Affected Systems
- Bitcoin Core
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete node shutdown and service disruption, requiring manual restart and potentially causing missed blocks or transaction processing delays.
Likely Case
Temporary node unavailability during header flood attacks, with automatic recovery after OOM kill and restart.
If Mitigated
Minimal impact with proper rate limiting or updated software that rejects invalid headers early.
🎯 Exploit Status
Attack requires sending specially crafted Bitcoin headers with minimum difficulty. The vulnerability was publicly disclosed with technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.15.0 and later
Vendor Advisory: https://bitcoincore.org/en/2024/07/03/disclose-header-spam/
Restart Required: Yes
Instructions:
1. Backup wallet.dat and configuration files. 2. Stop Bitcoin Core daemon. 3. Download Bitcoin Core 0.15.0 or later from bitcoincore.org. 4. Install the new version. 5. Restart Bitcoin Core daemon.
🔧 Temporary Workarounds
Disable incoming connections
allPrevent other nodes from connecting to your node, reducing attack surface
bitcoin-cli stop
Edit bitcoin.conf: listen=0
bitcoind -daemon
Rate limit peer connections
allLimit maximum connections to reduce impact of header floods
Edit bitcoin.conf: maxconnections=8
🧯 If You Can't Patch
- Monitor memory usage and restart Bitcoin Core if OOM kill occurs
- Implement network-level filtering to block suspicious header traffic
🔍 How to Verify
Check if Vulnerable:
Check Bitcoin Core version: bitcoin-cli getnetworkinfo | grep versionCheck Version:
bitcoin-cli getnetworkinfo | grep versionVerify Fix Applied:
Confirm version is 0.15.0 or higher and monitor for abnormal memory consumption during header processing📡 Detection & Monitoring
Log Indicators:
- OOM killer messages in system logs
- Bitcoin Core crash logs
- Excessive memory usage alerts
Network Indicators:
- High volume of header messages from single IPs
- Unusual header propagation patterns
SIEM Query:
process.name="bitcoind" AND (memory.usage>90% OR event.action="killed")