CVE-2022-23328
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account that all fully spend the full balance of the account to a victim Geth node, which can purge all of pending transactions in a victim node's memory pool and then occupy the memory pool to prevent new transactions from entering the pool, resulting in a denial of service (DoS).
Un fallo de diseño en todas las versiones de Go-Ethereum permite que un nodo atacante envíe 5120 transacciones pendientes de un precio de gas elevado desde una cuenta que gaste todo el saldo de la cuenta a un nodo Geth víctima, que puede purgar todas las transacciones pendientes en el pool de memoria de un nodo víctima y luego ocupar el pool de memoria para evitar que entren nuevas transacciones en el pool, resultando en una denegación de servicio (DoS)
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-01-18 CVE Reserved
- 2022-03-04 CVE Published
- 2024-08-03 CVE Updated
- 2024-08-03 First Exploit
- 2024-11-17 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-400: Uncontrolled Resource Consumption
CAPEC
References (4)
| URL | Tag | Source |
|---|---|---|
| http://ethereum.com | Product | |
| http://go-ethereum.com | Product |
| URL | Date | SRC |
|---|---|---|
| https://dl.acm.org/doi/pdf/10.1145/3460120.3485369 | 2024-08-03 | |
| https://tristartom.github.io/docs/ccs21.pdf | 2024-08-03 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Ethereum Search vendor "Ethereum" | Go Ethereum Search vendor "Ethereum" for product "Go Ethereum" | - | - |
Affected
| ||||||