Heap Exhaustion in libp2p Gossipsub Node.js

Executive Summary

This vulnerability exists in the libp2p JavaScript implementation of the libp2p networking stack, specifically in the @libp2p/gossipsub module prior to version 15.0.23. It involves three cooperating omissions that allow an unauthenticated single peer to exhaust the Node.js heap memory of any gossipsub node running with default options.

Essentially, an attacker can cause a denial of service by consuming all available heap memory on a target node, potentially causing the node to crash or become unresponsive.

Useful 0 Not Useful 0

Impact Analysis

The primary impact of this vulnerability is a denial of service (DoS) condition. An unauthenticated attacker can exhaust the heap memory of a gossipsub node, leading to crashes or degraded performance.

This can disrupt network communications and services relying on libp2p, potentially causing downtime or loss of availability.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade the @libp2p/gossipsub package to version 15.0.23 or later, where the issue has been patched.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unusual memory consumption and Node.js process crashes on systems running @libp2p/gossipsub versions prior to 15.0.23. Specifically, look for signs of rapid heap growth and event loop blocking caused by subscription flood RPC messages containing a large number of unique topic subscriptions.

Detection can involve inspecting network traffic for inbound RPC messages with an abnormally high number of unique topic subscriptions (up to 349,525 in a single 4MB frame).

Suggested commands include using Node.js process monitoring tools to observe heap usage and event loop delays, such as:

• Use `top` or `htop` to monitor overall memory usage of the Node.js process.
• Use Node.js built-in diagnostics or external tools like `clinic` or `node --inspect` to profile heap usage and event loop blocking.
• Capture network traffic with tools like `tcpdump` or `Wireshark` to filter and analyze inbound RPC messages to the gossipsub port, looking for unusually large subscription requests.
• Example tcpdump command to capture traffic on port 4001 (default libp2p port): `tcpdump -i any port 4001 -w capture.pcap`
• Analyze captured packets for RPC messages containing large subscription lists.

Useful 0 Not Useful 0