Nimiq Network Libp2p Uncontrolled Memory Allocation Vulnerability Leading to Denial-of-Service

A denial-of-service vulnerability has been identified in the 'nimiq/network-libp2p' subcrate of the Nimiq Proof-of-Stake client implementation. This issue arises from uncontrolled memory allocation in the 'Discovery' network message handling, where a buffer is allocated based on a length value provided by the peer, without enforcing an upper limit. As a result, a peer can cause allocations of up to 4 GB, leading to memory exhaustion and node crashes. This vulnerability can be repeatedly exploited, as Discovery messages are frequently exchanged for peer discovery.

Impact

Exploitation of this vulnerability can cause memory exhaustion, leading to node crashes.

Remediation

Users can upgrade to version 1.1.0 or later, where this vulnerability has been patched by limiting the discovery message size to 1 MB and implementing a mechanism to resize the message buffer incrementally as data is read.