Security advisories for bugs fixed as of Bitcoin Core 0.21.0 #1042

darosior · 2024-07-03T13:06:02Z

This publicly discloses 10 security vulnerabilities fixed in Bitcoin Core 0.21.0 or earlier versions.

These writeups result from a common effort to dig up and document past vulnerabilities with achow101 ajtowns fanquake dergoegge and sipa.

_posts/en/posts/2024-06-10-disclose-bip70-crash.md

_posts/en/posts/2024-06-10-disclose-orphan-dos.md

_posts/en/posts/2024-06-10-disclose_already_asked_for.md

_posts/en/posts/2024-06-10-disclose-timestamp-overflow.md

murchandamus

I noticed that all of the advisories share the same excerpt " Public disclosure of a DoS vulnerability affecting old versions of Bitcoin Core". Should these perhaps be individualized to actually summarize the content of each advisory?

murchandamus · 2024-07-03T13:11:45Z

_posts/en/posts/2024-06-10-disclose-bip70-crash.md

@@ -0,0 +1,46 @@
+---
+title: Disclosure: crash due to malicious BIP72 URI (<= version 0.19.2)
+name: blog-disclose-bip70-crash


The title says BIP 72, the name says BIP 70. Which one is it?

BIP72 is in the context of BIP70. The attacker exploits the BIP70 implementation, by leveraging a BIP72 feature. I think it's correct as is.

I see, thanks. The disclosure doesn’t mention BIP 70 at all except in the name, perhaps it would make sense to explain this in the body of the disclosure?

It now mentions BIP70 in the excerpt too, i think it's good enough?

_posts/en/posts/2024-06-10-disclose-bip70-crash.md

_posts/en/posts/2024-06-10-disclose-inv-buffer-blowup.md

_posts/en/posts/2024-06-10-disclose-orphan-dos.md

murchandamus · 2024-07-03T13:27:26Z

_posts/en/posts/2024-06-10-disclose-unbounded-banlist.md

+- 2020-07-07 Pieter's PR is merged
+- 2020-08-01 Bitcoin Core 0.20.1 is released with the fix
+- 2021-01-14 Bitcoin Core 0.21.0 is released with the fix
+- 2022-04-25 The last vulnerable Bitcoin Core version (0.20.0) goes EOL


According to old versions of the old lifecycle table (which were used to create the new table), v0.20.0 went end-of-life on 2022-02-01. One of the two should probably be amended.

Corollary: Should the EOL always be based on the release date of the Major version three later or the target release date of the Major version three later?

According to https://github.com/bitcoin/bitcoin/releases/tag/v23.0 and the dates at https://bitcoincore.org/bin/bitcoin-core-23.0/ 23.0 was released on April 25th. So i think the date here is correct.

Corollary: Should the EOL always be based on the release date of the Major version three later or the target release date of the Major version three later?

No strong opinion but i had assumed it's when the release 3 versions later actually get released.

_posts/en/posts/2024-06-10-disclose_already_asked_for.md

_posts/en/posts/2024-06-10-disclose_receive_buffer_oom.md

_posts/en/posts/2024-06-10-disclose_upnp_rce.md

_posts/en/posts/2024-06-10-disclose_already_asked_for.md

_posts/en/posts/2024-06-10-disclose-header-spam.md

_posts/en/posts/2024-06-10-disclose-bip70-crash.md

Should help catch issues like those in bitcoin-core#1042, which didn't cause the CI to fail. ```bash bundle exec jekyll server --future --drafts --unpublished --incremental --strict_front_matter ... Incremental build: enabled Generating... Error: YAML Exception reading /Users/michael/bitcoincore.org/_posts/en/posts/2024-06-10-disclose-bip70-crash.md: (<unknown>): mapping values are not allowed in this context at line 2 column 18 ------------------------------------------------ ```

darosior · 2024-07-03T14:38:12Z

Thanks everyone for the review. Addressed all comments in the latest push.

dergoegge

ACK 29f1c6c

sipa · 2024-07-03T15:06:13Z

*  8455:192: ERROR: Invalid first character of tag name '='.
        <h2><a href="/en/2024/06/10/disclose-getdata-cpu/" title="Disclosure of CPU DoS due to malicious P2P message (<= version 0.19.2)">Disclosure of CPU DoS due to malicious P2P message (<= version 0.19.2)</a></h2>
                                                                                                                                                                                               ^ (line 8455)

_posts/en/pages/2024-06-26-security-advisories.md

f703571 build: add --strict_front_matter to build invocation (fanquake) Pull request description: Should help catch issues like those in #1042, which didn't cause the CI to fail. ```bash bundle exec jekyll server --future --drafts --unpublished --incremental --strict_front_matter ... Incremental build: enabled Generating... Error: YAML Exception reading /bitcoincore.org/_posts/en/posts/2024-06-10-disclose-bip70-crash.md: (<unknown>): mapping values are not allowed in this context at line 2 column 18 ------------------------------------------------ ``` ACKs for top commit: dergoegge: utACK f703571 Tree-SHA512: f9e748ca356cac1043ce0458cd654eb041f446a10861b38d608b28c1fbb7f079bdf3bb2b9f06b0e37a962bf26d35563bf59a538deaf18ffe98b859ffb5cd6f97

darosior · 2024-07-03T15:23:30Z

*  8455:192: ERROR: Invalid first character of tag name '='.
        <h2><a href="/en/2024/06/10/disclose-getdata-cpu/" title="Disclosure of CPU DoS due to malicious P2P message (<= version 0.19.2)">Disclosure of CPU DoS due to malicious P2P message (<= version 0.19.2)</a></h2>
                                                                                                                                                                                               ^ (line 8455)

Looks like the CI doesn't like <=, can i just use ≤ with Jekyll?

darosior · 2024-07-03T15:29:37Z

I noticed that all of the advisories share the same excerpt " Public disclosure of a DoS vulnerability affecting old versions of Bitcoin Core". Should these perhaps be individualized to actually summarize the content of each advisory?

They are not. It depends on the nature of the vulnerability. For some it's DoS, for other it's RCE or even "censorship". Nonetheless i've now added an excerpt with more details about the content for each post.

*  8455:192: ERROR: Invalid first character of tag name '='.
        <h2><a href="/en/2024/06/10/disclose-getdata-cpu/" title="Disclosure of CPU DoS due to malicious P2P message (<= version 0.19.2)">Disclosure of CPU DoS due to malicious P2P message (<= version 0.19.2)</a></h2>
                                                                                                                                                                                               ^ (line 8455)

I've updated with using ≤ instead of using <=. Let's see what the linter says.

_posts/en/posts/2024-06-10-disclose_receive_buffer_oom.md

_posts/en/posts/2024-06-10-disclose_upnp_rce.md

achow101 · 2024-07-03T15:54:09Z

The blog published dates and the disclosure timeline don't match. The dates for the blog section are pulled from the dates in file name.

…dy_asked_for rolling) Co-Authored-By: Pieter Wuille <pieter@wuille.net>

Co-Authored-by: Niklas Gögge <n.goeggi@gmail.com>

darosior · 2024-07-03T15:57:10Z

Alright, did one last push to:

update the date in the filename to match today's instead of when i starting writing those up
address a couple nits
correct the type of the first post

darosior · 2024-07-03T15:58:07Z

The blog published dates and the disclosure timeline don't match. The dates for the blog section are pulled from the dates in file name.

Yeah i think this should be fixed now.

achow101 · 2024-07-03T16:16:26Z

ACK 0a549fa

sipa · 2024-07-03T16:16:44Z

ACK 0a549fa

fanquake

ACK 0a549fa

ariard · 2024-07-04T04:07:56Z

@darosior @fanquake @ajtowns @sipa @achow101 @dergoegge

As I suggested on your gist here, I think it would be a good idea to PGP-signed the security advisories to minimize infrastructure compromise risks like the website or github.com being tampered with. Especially, github their 2FA authentication is not great.

dergoegge reviewed Jul 3, 2024

View reviewed changes

murchandamus reviewed Jul 3, 2024

View reviewed changes

darosior force-pushed the 2406_historical_disclosures branch from 8ea36c6 to 815e630 Compare July 3, 2024 13:43

vnprc mentioned this pull request Jul 3, 2024

Socratic Seminar 31 - July 2024 TriangleBitDevs/TriangleBitDevs.github.io#23

Closed

bitschmidty reviewed Jul 3, 2024

View reviewed changes

_posts/en/posts/2024-06-10-disclose_already_asked_for.md Outdated Show resolved Hide resolved

glozow reviewed Jul 3, 2024

View reviewed changes

_posts/en/posts/2024-06-10-disclose-header-spam.md Outdated Show resolved Hide resolved

fanquake reviewed Jul 3, 2024

View reviewed changes

_posts/en/posts/2024-06-10-disclose-bip70-crash.md Outdated Show resolved Hide resolved

fanquake mentioned this pull request Jul 3, 2024

build: add --strict_front_matter to build invocation #1043

Merged

darosior force-pushed the 2406_historical_disclosures branch from 815e630 to 29f1c6c Compare July 3, 2024 14:36

dergoegge approved these changes Jul 3, 2024

View reviewed changes

benthecarman mentioned this pull request Jul 3, 2024

July 2024 austinbitdevs/austinbitdevs.com#35

Closed

fanquake reviewed Jul 3, 2024

View reviewed changes

_posts/en/pages/2024-06-26-security-advisories.md Outdated Show resolved Hide resolved

darosior force-pushed the 2406_historical_disclosures branch from 29f1c6c to d8bd2d6 Compare July 3, 2024 15:29

achow101 reviewed Jul 3, 2024

View reviewed changes

_posts/en/posts/2024-06-10-disclose_receive_buffer_oom.md Outdated Show resolved Hide resolved

achow101 reviewed Jul 3, 2024

View reviewed changes

_posts/en/posts/2024-06-10-disclose_upnp_rce.md Outdated Show resolved Hide resolved

posts: disclose historical DoS vulnerability (receive buffer)

39a9a30

darosior and others added 7 commits July 3, 2024 17:54

posts: disclose historical RCE vulnerability (miniupnpc)

9718761

posts: disclose historical DoS vulnerability (BIP70)

4b564d3

posts: disclose historical tx relay censorship vulnerability (g_alrea…

2d4af7c

…dy_asked_for rolling) Co-Authored-By: Pieter Wuille <pieter@wuille.net>

posts: disclose historical DoS vulnerability (unbounded banlist)

259217b

posts: disclose historical netsplit vulnerability (timestamp overflow)

f0756b7

Co-Authored-by: Niklas Gögge <n.goeggi@gmail.com>

posts: disclose historical DoS vulnerability (INV buffer blowup)

7cf880b

posts: disclose historical DoS vulnerability (GETDATA 100% CPU)

04a8f71

darosior added 3 commits July 3, 2024 17:54

posts: disclose historical DoS vulnerability (orphan resolution)

d2943c5

posts: disclose historical DoS vulnerability (header spam)

054d744

advisory page: show latest disclosure first

0a549fa

darosior force-pushed the 2406_historical_disclosures branch from d8bd2d6 to 0a549fa Compare July 3, 2024 15:55

fanquake approved these changes Jul 3, 2024

View reviewed changes

fanquake merged commit 958404b into bitcoin-core:master Jul 3, 2024
2 checks passed

darosior deleted the 2406_historical_disclosures branch July 3, 2024 16:30

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Security advisories for bugs fixed as of Bitcoin Core 0.21.0 #1042

Security advisories for bugs fixed as of Bitcoin Core 0.21.0 #1042

darosior commented Jul 3, 2024 •

edited by fanquake

Loading

murchandamus left a comment

murchandamus Jul 3, 2024

darosior Jul 3, 2024

murchandamus Jul 3, 2024

darosior Jul 3, 2024

murchandamus Jul 3, 2024

darosior Jul 3, 2024

darosior commented Jul 3, 2024

dergoegge left a comment

sipa commented Jul 3, 2024

darosior commented Jul 3, 2024 •

edited

Loading

darosior commented Jul 3, 2024

achow101 commented Jul 3, 2024

darosior commented Jul 3, 2024

darosior commented Jul 3, 2024

achow101 commented Jul 3, 2024

sipa commented Jul 3, 2024

fanquake left a comment

ariard commented Jul 4, 2024

Security advisories for bugs fixed as of Bitcoin Core 0.21.0 #1042

Security advisories for bugs fixed as of Bitcoin Core 0.21.0 #1042

Conversation

darosior commented Jul 3, 2024 • edited by fanquake Loading

murchandamus left a comment

Choose a reason for hiding this comment

murchandamus Jul 3, 2024

Choose a reason for hiding this comment

darosior Jul 3, 2024

Choose a reason for hiding this comment

murchandamus Jul 3, 2024

Choose a reason for hiding this comment

darosior Jul 3, 2024

Choose a reason for hiding this comment

murchandamus Jul 3, 2024

Choose a reason for hiding this comment

darosior Jul 3, 2024

Choose a reason for hiding this comment

darosior commented Jul 3, 2024

dergoegge left a comment

Choose a reason for hiding this comment

sipa commented Jul 3, 2024

darosior commented Jul 3, 2024 • edited Loading

darosior commented Jul 3, 2024

achow101 commented Jul 3, 2024

darosior commented Jul 3, 2024

darosior commented Jul 3, 2024

achow101 commented Jul 3, 2024

sipa commented Jul 3, 2024

fanquake left a comment

Choose a reason for hiding this comment

ariard commented Jul 4, 2024

darosior commented Jul 3, 2024 •

edited by fanquake

Loading

darosior commented Jul 3, 2024 •

edited

Loading