CVE-2023-34450 : What You Need to Know

This article provides detailed information about CVE-2023-34450, a vulnerability in CometBFT PeerState JSON serialization, impacting versions 0.34.28 and 0.37.1.

Understanding CVE-2023-34450

CometBFT, a Byzantine Fault Tolerant middleware, introduced a deadlock due to internal modifications that affected the serialization of struct

PeerState

to JSON. The deadlock occurs when the new function MarshallJSON is called from specific scenarios.

What is CVE-2023-34450?

The vulnerability in CometBFT's PeerState JSON serialization in versions 0.34.28 and 0.37.1 leads to a deadlock when function MarshallJSON is triggered. This deadlock impacts the node's functionality, causing certain scenarios to halt the system.

The Impact of CVE-2023-34450

The deadlock can halt the node in various scenarios depending on how the function is triggered. It affects communication channels, potentially leading to timeouts and exclusion of peers from the network until reconnection occurs.

Technical Details of CVE-2023-34450

The vulnerability arises when serializing

PeerState

struct to JSON, causing a deadlock. The issue was resolved in versions 0.34.29 and 0.37.2.

Vulnerability Description

The deadlock occurs when the MarshallJSON function is called under specific conditions, disrupting the system's operation and potential progress.

Affected Systems and Versions

Versions 0.34.28 and 0.37.1 of CometBFT are affected by this vulnerability, impacting systems that trigger the serialization of

PeerState

to JSON.

Exploitation Mechanism

The vulnerability can be exploited by triggering the MarshallJSON function in scenarios involving logging and RPC dump_consensus_state, leading to system halts and communication disruption.

Mitigation and Prevention

To address CVE-2023-34450, users are advised to apply immediate steps and implement long-term security practices to ensure system resilience.

Immediate Steps to Take

Avoid setting log output to "json" or consensus logging module to "debug" to prevent deadlock via logs.
Restrict access to RPC

dump_consensus_state

endpoint to prevent deadlock via RPC.

Long-Term Security Practices

Update to versions 0.34.29 or 0.37.2 where the vulnerability is resolved.

Patching and Updates

Ensure that the systems are updated to the patched versions to mitigate the deadlock vulnerability.