go-ethereum Denial-of-Service Vulnerability via Malicious Peer-to-Peer Message

A denial-of-service vulnerability has been identified in go-ethereum (geth) versions 1.14.0 prior to 1.14.13. This issue allows a vulnerable node to be forced to shut down or crash by sending a specially crafted message. The problem arises during the peer-to-peer connection handshake, where the EC public key from the remote party is not properly validated. By transmitting an all-zero public key, a crash can be triggered due to unexpected outcomes from the handshake process.

Impact

Exploitation of this vulnerability causes the Ethereum node to crash, disrupting its operation and potentially affecting network participation.

Remediation

Users can upgrade to go-ethereum version 1.14.13 or later to address this vulnerability. No additional workarounds are available.