Quantum Secular Labs / Blog / Advisories
CVE-2018-1000618: Eosio Project: Buffer overflow
CVE-2018-1000618 is rated critical with a CVSS v3.0 base score of 9.8 and affects Eosio Project. Per its scoring, it can be exploited over the network, without authentication, without any user interaction. The scored impact on confidentiality, integrity and availability is the highest available.
Vulnerability description
EOSIO/eos eos version after commit f1545dd0ae2b77580c2236fdb70ae7138d2c7168 contains a stack overflow vulnerability in abi_serializer that can result in attack eos network node. This attack appear to be exploitable via network request. This vulnerability appears to have been fixed in after commit cf7209e703e6d3f7a5413e0cb1fe88a4d8e4b38d .
Severity breakdown
CVSS v3.0 9.8: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector: Network. Exploitable remotely over the network, with no need for local or physical access.
- Attack complexity: Low. No special conditions; the attack can be repeated reliably.
- Privileges required: None. No account or prior access is needed.
- User interaction: None. No action from any user is needed.
- Scope: Unchanged. Impact stays within the vulnerable component.
- Confidentiality impact: High. Total loss of confidentiality; sensitive data can be fully disclosed.
- Integrity impact: High. Total loss of integrity; data or system state can be fully modified.
- Availability impact: High. Total loss of availability; the component can be shut down.
Underlying weakness
CWE-674: Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
Affected products
- Eosio Project: all versions listed by NVD