github - ghsa-hc82-w9v8-83pr

GHSA-HC82-W9V8-83PR

Vulnerability from github – Published: 2022-11-18 18:50 – Updated: 2022-11-18 18:50

Summary

Witness Block Parsing DoS Vulnerability

Details

Impact

All lnd nodes before version v0.15.4 are vulnerable to a block parsing bug that can cause a node to enter a degraded state once encountered. In this degraded state, nodes can continue to make payments and forward HTLCs, and close out channels. Opening channels is prohibited, and also on chain transaction events will be undetected.

This can cause loss of funds if a CSV expiry is researched during a breach attempt or a CLTV delta expires forgetting the funds in the HTLC.

Patches

A patch is available starting with lnd v0.15.4.

Workarounds

Nodes can use the lncli updatechanpolicy RPC call to increase their CLTV value to a very high amount or increase their fee policies. This will prevent nodes from routing through your node, meaning that no pending HTLCs can be present.

References

https://github.com/lightningnetwork/lnd/issues/7096

https://github.com/lightningnetwork/lnd/releases/tag/v0.15.4-beta

Severity ?

8.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/lightningnetwork/lnd"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.15.4-beta"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-39389"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-11-18T18:50:01Z",
    "nvd_published_at": "2022-11-17T22:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nAll lnd nodes before version `v0.15.4` are vulnerable to a block parsing bug that can cause a node to enter a degraded state once encountered. In this degraded state, nodes can continue to make payments and forward HTLCs, and close out channels. Opening channels is prohibited, and also on chain transaction events will be undetected. \n\nThis can cause loss of funds if a CSV expiry is researched during a breach attempt or a CLTV delta expires forgetting the funds in the HTLC. \n\n### Patches\n\nA patch is available starting with lnd `v0.15.4`. \n\n### Workarounds\n\nNodes can use the `lncli updatechanpolicy` RPC call to increase their CLTV value to a very high amount or increase their fee policies. This will prevent nodes from routing through your node, meaning that no pending HTLCs can be present. \n\n### References\n\nhttps://github.com/lightningnetwork/lnd/issues/7096\n\nhttps://github.com/lightningnetwork/lnd/releases/tag/v0.15.4-beta\n\n",
  "id": "GHSA-hc82-w9v8-83pr",
  "modified": "2022-11-18T18:50:01Z",
  "published": "2022-11-18T18:50:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/lightningnetwork/lnd/security/advisories/GHSA-hc82-w9v8-83pr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39389"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lightningnetwork/lnd/issues/7096"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lightningnetwork/lnd/pull/7098"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lightningnetwork/lnd"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lightningnetwork/lnd/releases/tag/v0.15.4-beta"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Witness Block Parsing DoS Vulnerability "
}

CVE-2022-39389 (GCVE-0-2022-39389)

Vulnerability from cvelistv5 – Published: 2022-11-17 00:00 – Updated: 2025-04-22 16:07

Title

Witness Block Parsing DoS Vulnerability in lnd

Summary

Lightning Network Daemon (lnd) is an implementation of a lightning bitcoin overlay network node. All lnd nodes before version `v0.15.4` are vulnerable to a block parsing bug that can cause a node to enter a degraded state once encountered. In this degraded state, nodes can continue to make payments and forward HTLCs, and close out channels. Opening channels is prohibited, and also on chain transaction events will be undetected. This can cause loss of funds if a CSV expiry is researched during a breach attempt or a CLTV delta expires forgetting the funds in the HTLC. A patch is available in `lnd` version 0.15.4. Users are advised to upgrade. Users unable to upgrade may use the `lncli updatechanpolicy` RPC call to increase their CLTV value to a very high amount or increase their fee policies. This will prevent nodes from routing through your node, meaning that no pending HTLCs can be present.

Severity ?

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

CWE

CWE-20 - Improper Input Validation

Assigner

GitHub_M

References

URL

Tags

	https://github.com/lightningnetwork/lnd/security/…
	https://github.com/lightningnetwork/lnd/issues/7096
	https://github.com/lightningnetwork/lnd/pull/7098
	https://github.com/lightningnetwork/lnd/releases/…

Impacted products

	Vendor	Product	Version
	lightningnetwork	lnd	Affected: < v0.15.4-beta

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T12:07:41.957Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/lightningnetwork/lnd/security/advisories/GHSA-hc82-w9v8-83pr"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/lightningnetwork/lnd/issues/7096"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/lightningnetwork/lnd/pull/7098"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/lightningnetwork/lnd/releases/tag/v0.15.4-beta"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-39389",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-22T15:39:14.564355Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-22T16:07:33.112Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "lnd",
          "vendor": "lightningnetwork",
          "versions": [
            {
              "status": "affected",
              "version": " \u003c v0.15.4-beta"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Lightning Network Daemon (lnd) is an implementation of a lightning bitcoin overlay network node. All lnd nodes before version `v0.15.4` are vulnerable to a block parsing bug that can cause a node to enter a degraded state once encountered. In this degraded state, nodes can continue to make payments and forward HTLCs, and close out channels. Opening channels is prohibited, and also on chain transaction events will be undetected. This can cause loss of funds if a CSV expiry is researched during a breach attempt or a CLTV delta expires forgetting the funds in the HTLC. A patch is available in `lnd` version 0.15.4. Users are advised to upgrade. Users unable to upgrade may use the `lncli updatechanpolicy` RPC call to increase their CLTV value to a very high amount or increase their fee policies. This will prevent nodes from routing through your node, meaning that no pending HTLCs can be present."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-11-17T00:00:00.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "url": "https://github.com/lightningnetwork/lnd/security/advisories/GHSA-hc82-w9v8-83pr"
        },
        {
          "url": "https://github.com/lightningnetwork/lnd/issues/7096"
        },
        {
          "url": "https://github.com/lightningnetwork/lnd/pull/7098"
        },
        {
          "url": "https://github.com/lightningnetwork/lnd/releases/tag/v0.15.4-beta"
        }
      ],
      "source": {
        "advisory": "GHSA-hc82-w9v8-83pr",
        "discovery": "UNKNOWN"
      },
      "title": "Witness Block Parsing DoS Vulnerability in lnd"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-39389",
    "datePublished": "2022-11-17T00:00:00.000Z",
    "dateReserved": "2022-09-02T00:00:00.000Z",
    "dateUpdated": "2025-04-22T16:07:33.112Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-HC82-W9V8-83PR

Impact

Patches

Workarounds

References

CVE-2022-39389 (GCVE-0-2022-39389)

Tags

Sightings

Nomenclature