CVE-2024-38365 – btcd did not correctly re-implement Bitcoin Core's "FindAndDelete()" functionality

https://notcve.org/view.php?id=CVE-2024-38365

btcd is an alternative full node bitcoin implementation written in Go (golang). The btcd Bitcoin client (versions 0.10 to 0.24) did not correctly re-implement Bitcoin Core's "FindAndDelete()" functionality. This logic is consensus-critical: the difference in behavior with the other Bitcoin clients can lead to btcd clients accepting an invalid Bitcoin block (or rejecting a valid one). This consensus failure can be leveraged to cause a chain split (accepting an invalid Bitcoin block) or be exploited to DoS the btcd nodes (rejecting a valid Bitcoin block). An attacker can create a standard transaction where FindAndDelete doesn't return a match but removeOpCodeByData does making btcd get a different sighash, leading to a chain split. • https://delvingbitcoin.org/t/cve-2024-38365-public-disclosure-btcd-findanddelete-bug/1184 https://github.com/btcsuite/btcd/commit/04469e600e7d4a58881e2e5447d19024e49800f5 https://github.com/btcsuite/btcd/releases/tag/v0.24.2 https://github.com/btcsuite/btcd/security/advisories/GHSA-27vh-h6mc-q6g8 • CWE-670: Always-Incorrect Control Flow Implementation •