NRDAX-T0199 - Peer-Record Flood OOM

gossip_abuse · active · first seen 2023-01-01

provenance: Reproduced in NullRabbit's attack-reproduction pipeline

mechanism

CVE-2023-40583: unchecked signed peer-record flood (peer-exchange) → go-libp2p peerstore OOM

instances (1)

chain	primitive	fidelity	origin	reproducer (bundle)	source
libp2p	libp2p_signed_peer_record_flood	lab	reverse-engineered-cve	libp2p_signed_peer_record_flood	https://github.com/advisories/GHSA-gcq9-qqwx-rgj3 ↗

references

cve: CVE-2023-40583

cve: CVE-2026-35405

vendor-advisory: GHPR-NethermindEth-nethermind-12211

vendor-advisory: GHREL-solana-labs-solana-v0.23.6

related (gossip_abuse)

NRDAX-T0001 - Addr Message Counter Overflow Crash active NRDAX-T0050 - DHT Sybil Content Censorship active NRDAX-T0120 - Integer-Overflow Panic Control Message active NRDAX-T0188 - Oversized Control-Message Array CPU Burn active NRDAX-T0192 - Oversized Transaction Block-Fill active NRDAX-T0295 - Sync-State Poisoning Via Fake Blocks active NRDAX-T0312 - Tx-Relay Throughput Jamming active NRDAX-T0326 - Unbounded Peer-Slot Sybil active

cite

https://nrdax.com/techniques/NRDAX-T0199

plain

NRDAX Registry. Technique NRDAX-T0199.

bibtex

@misc{nrdax_NRDAX_T0199,
  title = {Peer-Record Flood OOM (NRDAX-T0199)},
  howpublished = {NRDAX Registry},
  url = {https://nrdax.com/techniques/NRDAX-T0199},
}

json (csl)

{
  "id": "nrdax-NRDAX-T0199",
  "type": "dataset",
  "title": "Peer-Record Flood OOM (NRDAX-T0199)",
  "URL": "https://nrdax.com/techniques/NRDAX-T0199",
  "publisher": "NRDAX Registry"
}