Memory Exhaustion in libp2p Due to Unlimited Message IDs

Compliance Impact

The vulnerability in libp2p prior to version 16.0.0 allows oversized IHAVE and IWANT control message arrays to block the Node.js event loop, causing a denial of service (availability impact).

Since the impact is on availability only and does not affect confidentiality or integrity, the vulnerability could potentially affect compliance with standards and regulations that require high availability of systems, such as HIPAA and GDPR.

However, there is no direct information provided about data breaches or exposure of personal data, so the effect on compliance with data protection requirements (like confidentiality under GDPR or HIPAA) is not indicated.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade the libp2p package to version 16.0.0 or later, where the issue with oversized IHAVE and IWANT control message arrays causing Node.js event loop blocking has been fixed.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the libp2p JavaScript networking stack prior to version 16.0.0. The defaultDecodeRpcLimits configuration in @libp2p/gossipsub set the maximum number of IHAVE and IWANT message IDs to Infinity. This allowed attackers to send oversized IHAVE and IWANT control message arrays, which caused the system to synchronously iterate over roughly 180,000 message IDs per 4 MB frame. This iteration blocks the Node.js event loop, leading to a denial of service.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can cause a denial of service (DoS) by blocking the Node.js event loop. When oversized IHAVE and IWANT message arrays are processed, the event loop is synchronously blocked, which can halt the application's ability to handle other tasks or requests. This can lead to application unavailability or degraded performance.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unusually large IHAVE and IWANT control messages in the libp2p Gossipsub traffic, especially those containing oversized arrays of message IDs (around 180,000 IDs per 4MB frame). Detection involves identifying high CPU usage or blocked Node.js event loops caused by processing these large control messages.

Specifically, you should look for signs such as event loop blocking for durations longer than the heartbeat interval (e.g., blocking for ~1500ms within a 1000ms heartbeat) and sustained high event loop utilization (above 80%) due to IWANT messages.

While no explicit commands are provided in the resources, you can use Node.js profiling tools or system monitoring commands to detect symptoms:

• Use Node.js built-in diagnostics like `node --inspect` or `clinic doctor` to profile event loop delays.
• Monitor CPU usage and event loop lag with tools such as `top`, `htop`, or `pidstat` on the host system.
• Capture and analyze network traffic to identify large Gossipsub IHAVE/IWANT messages, for example using `tcpdump` or `wireshark` filtering on libp2p ports.
• Log and inspect inbound control messages in the application if logging is enabled, looking for message arrays exceeding normal sizes.

Useful 0 Not Useful 0