{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata — refreshed continuously.","feed_url":"https://feed.craftedsignal.io/tags/bls/","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cves":[],"_cs_exploited":false,"_cs_products":["nimiq-primitives"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","nimiq","bls"],"_cs_type":"advisory","_cs_vendors":["Nimiq"],"content_html":"\u003cp\u003eA critical vulnerability exists in Nimiq\u0026rsquo;s core-rs-albatross library, specifically within the nimiq-primitives crate, affecting versions 0.2.0 and earlier. An attacker can exploit this vulnerability by sending a malicious election macro block to a Nimiq node. This block contains an invalid compressed BLS voting key. When the node attempts to process this block, specifically during the hashing of the election macro header and the validation of the validators set via \u003ccode\u003eValidators::voting_keys()\u003c/code\u003e, the \u003ccode\u003evalidator.voting_key.uncompress().unwrap()\u003c/code\u003e function is triggered. Due to the invalid BLS key, this operation results in a panic, effectively crashing the Nimiq node and causing a denial-of-service condition. The vulnerability was patched in version 1.3.0 of the core-rs-albatross library.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a vulnerable Nimiq node running a version of \u003ccode\u003enimiq-primitives\u003c/code\u003e less than or equal to 0.2.0.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious election macro block.\u003c/li\u003e\n\u003cli\u003eThe malicious block contains an invalid compressed BLS voting key within the \u003ccode\u003evalidators\u003c/code\u003e set.\u003c/li\u003e\n\u003cli\u003eThe attacker sends the crafted block to the target Nimiq node via the peer-to-peer network.\u003c/li\u003e\n\u003cli\u003eThe Nimiq node receives the block and begins processing it.\u003c/li\u003e\n\u003cli\u003eDuring the hashing of the election macro header, the \u003ccode\u003evalidators\u003c/code\u003e set is processed.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eValidators::voting_keys()\u003c/code\u003e function is called, which attempts to uncompress the BLS voting key.\u003c/li\u003e\n\u003cli\u003eDue to the invalid compressed BLS key, the \u003ccode\u003evalidator.voting_key.uncompress().unwrap()\u003c/code\u003e function panics, causing the node to crash and leading to a denial of service.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability leads to a denial-of-service condition for the targeted Nimiq node. This can disrupt network operations, prevent legitimate transactions from being processed, and potentially impact the overall stability of the Nimiq network. The vulnerability allows any untrusted peer to trigger the crash.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to version 1.3.0 or later of the \u003ccode\u003ecore-rs-albatross\u003c/code\u003e library to patch CVE-2026-34065.\u003c/li\u003e\n\u003cli\u003eImplement rate limiting on incoming peer connections to mitigate the impact of malicious blocks being sent to the node.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-24T12:00:00Z","date_published":"2024-01-24T12:00:00Z","id":"/briefs/2024-01-nimiq-panic/","summary":"An unauthenticated peer can crash a Nimiq node by sending a malformed election macro block containing an invalid BLS voting key, leading to a denial of service.","title":"Nimiq Node Panic due to Invalid BLS Key","url":"https://feed.craftedsignal.io/briefs/2024-01-nimiq-panic/"}],"language":"en","title":"CraftedSignal Threat Feed — Bls","version":"https://jsonfeed.org/version/1.1"}