CVE-2023-34451 Explained : Impact and Mitigation

CometBFT may duplicate transactions in the mempool's data structures leading to a high severity vulnerability with a base score of 8.2.

Understanding CVE-2023-34451

This vulnerability in CometBFT can result in the duplication of transactions in the mempool's data structures, impacting the reliability and security of the system.

What is CVE-2023-34451?

CometBFT, a Byzantine Fault Tolerant (BFT) middleware, experiences issues in maintaining synchronization between the list and map data structures in transaction tracking, allowing for transaction duplication.

The Impact of CVE-2023-34451

The vulnerability can lead to a large number of stuck transactions in the mempool, potentially causing disruption and facilitating attacks aimed at bringing down the target node.

Technical Details of CVE-2023-34451

CometBFT ensures failover in distributed systems but is affected by the inconsistency between its data structures, permitting duplicate transactions.

Vulnerability Description

Versions prior to

0.34.29

and

0.37.2

are vulnerable, with duplicated transactions remaining in the mempool even after being committed to a block, necessitating node restarts for removal.

Affected Systems and Versions

Vendor: cometbft
Product: cometbft
Affected Versions:
< 0.34.29

>= 0.37.0, < 0.37.2

Exploitation Mechanism

Attackers can exploit this vulnerability to flood the mempool with duplicate transactions, potentially causing denial of service attacks against targeted nodes.

Mitigation and Prevention

To address CVE-2023-34451, immediate steps, long-term security practices, and patching recommendations are crucial.

Immediate Steps to Take

Update to version

0.34.29

or

0.37.2

to mitigate the vulnerability.
Implement workarounds like increasing

cache_size

in

config.toml

and restricting transaction submission RPCs.

Long-Term Security Practices

Regularly monitor and maintain synchronization between data structures.
Conduct security audits to identify and address vulnerabilities.

Patching and Updates

Ensure timely application of patches and updates to maintain system integrity and prevent exploitation of known vulnerabilities.