CVE-2020-26240 - OpenCVE

Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. An ethash mining DAG generation flaw in Geth before version 1.9.24 could cause miners to erroneously calculate PoW in an upcoming epoch (estimated early January, 2021). This happened on the ETC chain on 2020-11-06. This issue is relevant only for miners, non-mining nodes are unaffected. This issue is fixed as of 1.9.24

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:L/Au:N/C:N/I:P/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Ethereum	Go Ethereum

Configuration 1 [-]

cpe:2.3:a:ethereum:go_ethereum:*:*:*:*:*:*:*:*

References

Link	Resource
https://blog.ethereum.org/2020/11/12/geth_security_release/	Vendor Advisory
https://github.com/ethereum/go-ethereum/commit/d990df909d7839640143344e79356754384dcdd0	Patch Third Party Advisory
https://github.com/ethereum/go-ethereum/pull/21793	Patch Third Party Advisory
https://github.com/ethereum/go-ethereum/security/advisories/GHSA-v592-xf75-856p	Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: GitHub_M

Published: 2020-11-25T01:25:27

Updated: 2020-11-25T01:25:27

Reserved: 2020-10-01T00:00:00

Link: CVE-2020-26240

JSON object: View

NVD Information

Status : Analyzed

Published: 2020-11-25T02:15:10.923

Modified: 2020-12-03T15:16:13.717

Link: CVE-2020-26240

JSON object: View

Redhat Information

No data.

CWE

CWE-682

{"containers": {"cna": {"affected": [{"product": "go-ethereum", "vendor": "ethereum", "versions": [{"status": "affected", "version": "< 1.9.24"}]}], "descriptions": [{"lang": "en", "value": "Go Ethereum, or \"Geth\", is the official Golang implementation of the Ethereum protocol. An ethash mining DAG generation flaw in Geth before version 1.9.24 could cause miners to erroneously calculate PoW in an upcoming epoch (estimated early January, 2021). This happened on the ETC chain on 2020-11-06. This issue is relevant only for miners, non-mining nodes are unaffected. This issue is fixed as of 1.9.24"}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-682", "description": "CWE-682: Incorrect Calculation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-11-25T01:25:27", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://blog.ethereum.org/2020/11/12/geth_security_release/"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ethereum/go-ethereum/security/advisories/GHSA-v592-xf75-856p"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/ethereum/go-ethereum/pull/21793"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/ethereum/go-ethereum/commit/d990df909d7839640143344e79356754384dcdd0"}], "source": {"advisory": "GHSA-v592-xf75-856p", "discovery": "UNKNOWN"}, "title": "Erroneous Proof of Work calculation in geth", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2020-26240", "STATE": "PUBLIC", "TITLE": "Erroneous Proof of Work calculation in geth"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "go-ethereum", "version": {"version_data": [{"version_value": "< 1.9.24"}]}}]}, "vendor_name": "ethereum"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Go Ethereum, or \"Geth\", is the official Golang implementation of the Ethereum protocol. An ethash mining DAG generation flaw in Geth before version 1.9.24 could cause miners to erroneously calculate PoW in an upcoming epoch (estimated early January, 2021). This happened on the ETC chain on 2020-11-06. This issue is relevant only for miners, non-mining nodes are unaffected. This issue is fixed as of 1.9.24"}]}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-682: Incorrect Calculation"}]}]}, "references": {"reference_data": [{"name": "https://blog.ethereum.org/2020/11/12/geth_security_release/", "refsource": "MISC", "url": "https://blog.ethereum.org/2020/11/12/geth_security_release/"}, {"name": "https://github.com/ethereum/go-ethereum/security/advisories/GHSA-v592-xf75-856p", "refsource": "CONFIRM", "url": "https://github.com/ethereum/go-ethereum/security/advisories/GHSA-v592-xf75-856p"}, {"name": "https://github.com/ethereum/go-ethereum/pull/21793", "refsource": "MISC", "url": "https://github.com/ethereum/go-ethereum/pull/21793"}, {"name": "https://github.com/ethereum/go-ethereum/commit/d990df909d7839640143344e79356754384dcdd0", "refsource": "MISC", "url": "https://github.com/ethereum/go-ethereum/commit/d990df909d7839640143344e79356754384dcdd0"}]}, "source": {"advisory": "GHSA-v592-xf75-856p", "discovery": "UNKNOWN"}}}}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2020-26240", "datePublished": "2020-11-25T01:25:27", "dateReserved": "2020-10-01T00:00:00", "dateUpdated": "2020-11-25T01:25:27", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ethereum:go_ethereum:*:*:*:*:*:*:*:*", "matchCriteriaId": "9FD25FC5-2D0F-41D2-BE6E-34EF9AFA0A08", "versionEndExcluding": "1.9.24", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Go Ethereum, or \"Geth\", is the official Golang implementation of the Ethereum protocol. An ethash mining DAG generation flaw in Geth before version 1.9.24 could cause miners to erroneously calculate PoW in an upcoming epoch (estimated early January, 2021). This happened on the ETC chain on 2020-11-06. This issue is relevant only for miners, non-mining nodes are unaffected. This issue is fixed as of 1.9.24"}, {"lang": "es", "value": "Go Ethereum, o \"Geth\", es la implementaci\u00f3n oficial de Golang del protocolo Ethereum. Un fallo de generaci\u00f3n DAG de miner\u00eda ethash en Geth versiones anteriores a 1.9.24, podr\u00eda causar a unos mineros calcular err\u00f3neamente PoW en una \u00e9poca pr\u00f3xima (estimada a principios de enero de 2021). Esto sucedi\u00f3 en la cadena ETC el 06-11-2020. Este problema es relevante solo para mineros, los nodos que no son mineros no est\u00e1n afectados. Este problema es corregido desde la versi\u00f3n 1.9.24"}], "id": "CVE-2020-26240", "lastModified": "2020-12-03T15:16:13.717", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2020-11-25T02:15:10.923", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://blog.ethereum.org/2020/11/12/geth_security_release/"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/ethereum/go-ethereum/commit/d990df909d7839640143344e79356754384dcdd0"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/ethereum/go-ethereum/pull/21793"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/ethereum/go-ethereum/security/advisories/GHSA-v592-xf75-856p"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-682"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-682"}], "source": "security-advisories@github.com", "type": "Secondary"}]}