Disk Storage Exhaustion in libp2p Kad-DHT Node

Compliance Impact

The vulnerability allows an unauthenticated remote peer to exhaust the disk storage of a libp2p kad-dht node running in server mode by sending unbounded PUT_VALUE messages. This results in denial of service by making the node unavailable.

While the CVE description does not explicitly mention compliance with standards such as GDPR or HIPAA, the denial of service caused by disk exhaustion could impact availability requirements under these regulations.

However, since there is no direct compromise of confidentiality or integrity of data, the impact on compliance with data protection regulations is limited to availability concerns.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in libp2p, a JavaScript implementation of the libp2p networking stack, specifically in the @libp2p/kad-dht module running in server mode prior to version 16.2.6.

An unauthenticated remote peer can send an unlimited stream of PUT_VALUE messages with specially crafted keys that bypass all content validation.

Because there is no need for credentials, prior relationship, or protocol deviation beyond the crafted key, the victim node's datastore can be filled until the host's disk storage is exhausted.

This causes the node to become unavailable due to disk exhaustion.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to a denial of service condition by exhausting the disk storage of any @libp2p/kad-dht node running in server mode.

An attacker can cause the victim node to become unavailable by filling its datastore with unbounded PUT_VALUE messages.

This can disrupt services relying on the affected node, potentially causing downtime and loss of availability.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade the @libp2p/kad-dht node to version 16.2.6 or later, where the issue has been patched.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for an unusually high volume of PUT_VALUE messages sent to any @libp2p/kad-dht node running in server mode. Specifically, look for streams of messages with keys that bypass normal content validation, especially keys with fewer than three slash-delimited parts.

Since the attack involves sending large numbers of PUT_VALUE RPC messages (each up to 4 MB) potentially over multiple concurrent streams (up to 32), network traffic analysis tools can be used to detect abnormal traffic patterns targeting the DHT server nodes.

Suggested commands or approaches include:

• Use packet capture tools like tcpdump or Wireshark to filter and analyze traffic on the ports used by libp2p nodes, looking for excessive PUT_VALUE RPC messages.
• Example tcpdump command to capture traffic on the default libp2p port (replace <port> with actual port): tcpdump -i <interface> port <port> -w capture.pcap
• Analyze captured traffic for repeated PUT_VALUE messages with keys that do not conform to expected validation rules (e.g., keys with fewer than three slash-delimited parts).
• Monitor disk usage on the node hosting the @libp2p/kad-dht server for rapid increases that could indicate disk exhaustion attacks.
• Use application-level logging or debugging features in libp2p to log incoming PUT_VALUE requests and inspect for abnormal patterns.

Useful 0 Not Useful 0