CVE-2022-39389
Witness Block Parsing DoS Vulnerability in lnd
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
Lightning Network Daemon (lnd) is an implementation of a lightning bitcoin overlay network node. All lnd nodes before version `v0.15.4` are vulnerable to a block parsing bug that can cause a node to enter a degraded state once encountered. In this degraded state, nodes can continue to make payments and forward HTLCs, and close out channels. Opening channels is prohibited, and also on chain transaction events will be undetected. This can cause loss of funds if a CSV expiry is researched during a breach attempt or a CLTV delta expires forgetting the funds in the HTLC. A patch is available in `lnd` version 0.15.4. Users are advised to upgrade. Users unable to upgrade may use the `lncli updatechanpolicy` RPC call to increase their CLTV value to a very high amount or increase their fee policies. This will prevent nodes from routing through your node, meaning that no pending HTLCs can be present.
Lightning Network Daemon (lnd) es una implementación de un nodo de red superpuesto de bitcoin relámpago. Todos los nodos lnd anteriores a la versión `v0.15.4` son vulnerables a un error de análisis de bloques que puede hacer que un nodo entre en un estado degradado una vez encontrado. En este estado degradado, los nodos pueden continuar realizando pagos y reenviando HTLC y cerrar canales. Está prohibido abrir canales y tampoco se detectarán eventos de transacciones en cadena. Esto puede provocar la pérdida de fondos si se investiga el vencimiento de un CSV durante un intento de infracción o si un delta de CLTV expira olvidándose de los fondos en el HTLC. Hay un parche disponible en la versión 0.15.4 de `lnd`. Se recomienda a los usuarios que actualicen. Los usuarios que no puedan actualizar pueden usar la llamada RPC `lncli updatechanpolicy` para aumentar su valor CLTV a una cantidad muy alta o aumentar sus políticas de tarifas. Esto evitará que los nodos se enruten a través de su nodo, lo que significa que no puede haber ningún HTLC pendiente.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-09-02 CVE Reserved
- 2022-11-17 CVE Published
- 2024-06-09 EPSS Updated
- 2024-08-03 CVE Updated
- 2024-08-03 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-20: Improper Input Validation
CAPEC
References (4)
| URL | Tag | Source |
|---|---|---|
| https://github.com/lightningnetwork/lnd/releases/tag/v0.15.4-beta | Release Notes | |
| https://github.com/lightningnetwork/lnd/security/advisories/GHSA-hc82-w9v8-83pr | Third Party Advisory |
| URL | Date | SRC |
|---|---|---|
| https://github.com/lightningnetwork/lnd/issues/7096 | 2024-08-03 |
| URL | Date | SRC |
|---|---|---|
| https://github.com/lightningnetwork/lnd/pull/7098 | 2022-11-22 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Btcd Project Search vendor "Btcd Project" | Btcd Search vendor "Btcd Project" for product "Btcd" | < 0.23.3 Search vendor "Btcd Project" for product "Btcd" and version " < 0.23.3" | - |
Affected
| ||||||
| Lightning Network Daemon Project Search vendor "Lightning Network Daemon Project" | Lightning Network Daemon Search vendor "Lightning Network Daemon Project" for product "Lightning Network Daemon" | < 0.15.4 Search vendor "Lightning Network Daemon Project" for product "Lightning Network Daemon" and version " < 0.15.4" | - |
Affected
| ||||||