NRDAX-T0050 - DHT Sybil Content Censorship

gossip_abuse · active · first seen 2023-01-01

provenance: Reproduced in NullRabbit's attack-reproduction pipeline

mechanism

CVE-2023-26248 / GHSA-mqr9-hjr8-2m9w: Content Censorship in IPFS via Kademlia DHT abuse. The libp2p Kademlia DHT (go-libp2p-kad-dht (Go; as shipped in go-ipfs/kubo), affected go-libp2p-kad-dht <= 0.20

instances (1)

chain	primitive	fidelity	origin	reproducer (bundle)	source
ipfs	ipfs_dht_sybil_censorship	lab	reverse-engineered-cve	ipfs_dht_sybil_censorship	https://github.com/advisories/GHSA-mqr9-hjr8-2m9w ↗

references

cve: CVE-2023-26248

related (gossip_abuse)

NRDAX-T0001 - Addr Message Counter Overflow Crash active NRDAX-T0120 - Integer-Overflow Panic Control Message active NRDAX-T0188 - Oversized Control-Message Array CPU Burn active NRDAX-T0192 - Oversized Transaction Block-Fill active NRDAX-T0199 - Peer-Record Flood OOM active NRDAX-T0295 - Sync-State Poisoning Via Fake Blocks active NRDAX-T0312 - Tx-Relay Throughput Jamming active NRDAX-T0326 - Unbounded Peer-Slot Sybil active

cite

https://nrdax.com/techniques/NRDAX-T0050

plain

NRDAX Registry. Technique NRDAX-T0050.

bibtex

@misc{nrdax_NRDAX_T0050,
  title = {DHT Sybil Content Censorship (NRDAX-T0050)},
  howpublished = {NRDAX Registry},
  url = {https://nrdax.com/techniques/NRDAX-T0050},
}

json (csl)

{
  "id": "nrdax-NRDAX-T0050",
  "type": "dataset",
  "title": "DHT Sybil Content Censorship (NRDAX-T0050)",
  "URL": "https://nrdax.com/techniques/NRDAX-T0050",
  "publisher": "NRDAX Registry"
}