go-ethereum ECIES Cryptography Vulnerability Leading to Node Key Exposure

A vulnerability in the ECIES cryptography implementation of go-ethereum (Geth) versions through 1.16.8 allows attackers to extract bits of the p2p node key. This issue is resolved in Geth versions 1.16.9 and 1.17.0. After upgrading, Geth maintainers recommend rotating the node key by removing the nodekey file from the data directory before restarting Geth.

Impact

Exploitation of this vulnerability could lead to unauthorized extraction of the p2p node key, potentially allowing for impersonation of the node in the peer-to-peer network.

Remediation

Users should upgrade to Geth versions 1.16.9 or 1.17.0 and rotate the node key by removing the nodekey file from the data directory before restarting Geth.