CVE-2024-38365
highPriorität · verfolgen · 32EPSS 0.010 · 63. PerzentilDEEUUSEPSS · bewertet 2026-10-27
btcd is an alternative full node bitcoin implementation written in Go (golang). The btcd Bitcoin client (versions 0.10 to 0.24) did not correctly re-implement Bitcoin Core's "FindAndDelete()" functionality. This logic is consensus-critical: the difference in behavior with the other Bitcoin clients can lead to btcd clients accepting an invalid Bitcoin block (or rejecting a valid one). This consensus failure can be leveraged to cause a chain split (accepting an invalid Bitcoin block) or be exploited to DoS the btcd nodes (rejecting a valid Bitcoin block). An attacker can create a standard transaction where FindAndDelete doesn't return a match but removeOpCodeByData does making btcd get a different sighash, leading to a chain split. Importantly, this vulnerability can be exploited remotely by any Bitcoin user and does not require any hash power. This is because the difference in behavior can be triggered by a "standard" Bitcoin transaction, that is a transaction which gets relayed through the P2P network before it gets included in a Bitcoin block. `removeOpcodeByData(script []byte, dataToRemove []byte)` removes any data pushes from `script` that contain `dataToRemove`. However, `FindAndDelete` only removes exact matches. So for example, with `script = "<data> <data||foo>"` and `dataToRemove = "data"` btcd will remove both data pushes but Bitcoin Core's `FindAndDelete` only removes the first `<data>` push. This has been patched in btcd version v0.24.2. Users are advised to upgrade. There are no known workarounds for this issue.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- Behobengovulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch as component of SUSE Linux Enterprise Module for Package Hub 15 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Behobengovulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch as component of SUSE Linux Enterprise Module for Package Hub 15 SP6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Behobengovulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch as component of openSUSE Leap 15.5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Behobengovulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Behobengovulncheck-vulndb-0.0.20241104T154416-5.1.noarch as component of SUSE Package Hub 12suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (3)
Betroffene Produkte und Versionsbereiche.
Advisories (4)
Hersteller- und Ökosystem-Meldungen dazu.
- SUSE-SU-2024:3911-1Security update for govulncheck-vulndb2024-11-05csaf · suse_csafDE
Security update for govulncheck-vulndb
- openSUSE-SU-2024:0350-1Security update for govulncheck-vulndb2024-11-05csaf · suse_csafDE
Security update for govulncheck-vulndb
- GHSA-27vh-h6mc-q6g8btcd did not correctly re-implement Bitcoin Core's "FindAndDelete()" functionality2024-10-10ghsa · osvUS
### Impact The btcd Bitcoin client (versions 0.10 to 0.24) did not correctly re-implement Bitcoin Core's "FindAndDelete()" functionality. This logic is consensus-critical: the difference in behavior with the other Bitcoin clients can lead to btcd clients accepting an invalid Bitcoin block (or rejecting a valid one). This consensus failure can be leveraged to cause a chain split (accepting an invalid Bitcoin block) or be exploited to DoS the btcd nodes (rejecting a valid Bitcoin block). An attacker can create a standard transaction where FindAndDelete doesn't return a match but removeOpCodeByData does making btcd get a different sighash, leading to a chain split. Importantly, this vulnerability can be exploited remotely by any Bitcoin user and does not require any hash power. This is because the difference in behavior can be triggered by a "standard" Bitcoin transaction, that is a transaction which gets relayed through the P2P network before it gets included in a Bitcoin block. #### `FindAndDelete` vs. `removeOpcodeByData` `removeOpcodeByData(script []byte, dataToRemove []byte)` removes any data pushes from `script` that *contain* `dataToRemove`. However, `FindAndDelete` only removes *exact* matches. So for example, with `script = "<data> <data||foo>"` and `dataToRemove = "data"` btcd will remove both data pushes but Bitcoin Core's `FindAndDelete` only removes the first `<data>` push. ### Patches This has been patched in `btcd` version v0.24.2-beta. ### References `FindAndDelete`: https://github.com/btcsuite/btcd/security/advisories/GHSA-27vh-h6mc-q6g8
- GO-2024-3189Consensus failure in github.com/btcsuite/btcd2024-10-15vendor · osvUS
The btcd Bitcoin client (versions 0.10 to 0.24) did not correctly re-implement Bitcoin Core's 'FindAndDelete()' functionality, causing discrepancies in the validation of Bitcoin blocks. This can lead to a chain split (accepting an invalid block) or Denial of Service (DoS) attacks (rejecting a valid block). An attacker can trigger this vulnerability by constructing a 'standard' Bitcoin transaction that exhibits different behaviors in 'FindAndDelete()' and 'removeOpcodeByData()'.
auch bekannt als (5)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (14)
Externe Belege — Patches, Meldungen, Analysen.
- https://cxsecurity.com/cveshow/CVE-2024-38365/cnnvd
- https://delvingbitcoin.org/t/cve-2024-38365-public-disclosure-btcd-findanddelete-bug/1184cnnvd
- https://github.com/btcsuite/btcd/commit/04469e600e7d4a58881e2e5447d19024e49800f5cnnvd
- https://github.com/btcsuite/btcd/releases/tag/v0.24.2cnnvd
- https://github.com/btcsuite/btcd/security/advisories/GHSA-27vh-h6mc-q6g8cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2024-38365cnnvd
- https://delvingbitcoin.org/t/cve-2024-38365-public-disclosure-btcd-findanddelete-bug/1184enisa_euvd
- https://github.com/btcsuite/btcd/commit/04469e600e7d4a58881e2e5447d19024e49800f5enisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan