Executive Summary

This vulnerability exists in Nimiq's network-libp2p implementation prior to version 1.3.0. The network-libp2p discovery uses a libp2p ConnectionHandler state machine that assumes there is at most one inbound and one outbound discovery substream per connection. If a remote peer opens or negotiates the discovery protocol substream a second time on the same connection, the handler triggers a panic instead of failing safely. This panic causes the networking task (swarm) to crash remotely, taking the node's peer-to-peer networking offline until it is restarted.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is a remote denial of service on the affected node's networking. An attacker can cause the networking task to crash by opening multiple discovery substreams on the same connection, which results in the node's peer-to-peer networking going offline until the node is restarted. This disrupts network availability and connectivity.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed in network-libp2p version 1.3.0. The immediate step to mitigate this vulnerability is to upgrade to version 1.3.0 or later.

No known workarounds are available, so upgrading is the only effective mitigation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts the availability of the Nimiq network-libp2p node by causing a remote crash of the networking task, taking the node's peer-to-peer networking offline until restart.

There is no impact on confidentiality or integrity of data, as the vulnerability does not allow unauthorized data access or modification.

Since the vulnerability affects availability only and does not expose or compromise personal or sensitive data, it does not directly affect compliance with data protection regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability manifests when a remote peer opens or negotiates a second discovery protocol substream on the same connection, causing the networking task to panic and crash. Detection involves monitoring for panic messages such as "Inbound already connected" or "Outbound already connected" in the logs of the network-libp2p component.

Since the vulnerability causes a crash due to duplicate discovery substreams, you can detect attempts by observing logs or network behavior indicating repeated discovery substream negotiations on the same connection.

There are no specific commands provided in the resources to detect this vulnerability directly on your network or system.

Useful 0 Not Useful 0