libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arithmetic overflow. A malicious rendezvous server can send a discovery response with an unbounded TTL value that causes the client node process to panic when computing the expiry timer.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
libp2p:libp2p-rendezvous
References 4
https://docs.rs/crate/libp2p-rendezvous/0.17.1/source/src/client.rs
disclosure@vulncheck.com
https://gist.github.com/thesmartshadow/25ef03f7ebbd12118a9d27695c885989
disclosure@vulncheck.com
https://github.com/libp2p/rust-libp2p
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/libp2p-rendezvous-through-0.17.1-denial-of…
disclosure@vulncheck.com