NRDAX-T0001 - Addr Message Counter Overflow Crash

gossip_abuse · active · first seen 2024-01-01

provenance: Reproduced in NullRabbit's attack-reproduction pipeline

mechanism

CVE-2024-52919 (GHSA-qwp9-p9rr-h729): addr flood → CAddrMan 32-bit nIdCount overflow → assertion abort

instances (1)

chain	primitive	fidelity	origin	reproducer (bundle)	source
litecoin	btc_addr_overflow_flood	lab	reverse-engineered-cve	btc_addr_overflow_flood	https://bitcoincore.org/en/2025/04/28/disclose-cve-2024-52919/ ↗

references

cve: CVE-2024-52919

related (gossip_abuse)

NRDAX-T0050 - DHT Sybil Content Censorship active NRDAX-T0120 - Integer-Overflow Panic Control Message active NRDAX-T0188 - Oversized Control-Message Array CPU Burn active NRDAX-T0192 - Oversized Transaction Block-Fill active NRDAX-T0199 - Peer-Record Flood OOM active NRDAX-T0295 - Sync-State Poisoning Via Fake Blocks active NRDAX-T0312 - Tx-Relay Throughput Jamming active NRDAX-T0326 - Unbounded Peer-Slot Sybil active

cite

https://nrdax.com/techniques/NRDAX-T0001

plain

NRDAX Registry. Technique NRDAX-T0001.

bibtex

@misc{nrdax_NRDAX_T0001,
  title = {Addr Message Counter Overflow Crash (NRDAX-T0001)},
  howpublished = {NRDAX Registry},
  url = {https://nrdax.com/techniques/NRDAX-T0001},
}

json (csl)

{
  "id": "nrdax-NRDAX-T0001",
  "type": "dataset",
  "title": "Addr Message Counter Overflow Crash (NRDAX-T0001)",
  "URL": "https://nrdax.com/techniques/NRDAX-T0001",
  "publisher": "NRDAX Registry"
}