Revofusion

**Name of the Vulnerable Software and Affected Versions** libp2p-rust versions prior to 0.49.3 **Description** The libp2p-rust Gossipsub implementation is susceptible to a remote, unauthenticated denial-of-service condition. The implementation accepts attacker-controlled PRUNE backoff values and performs unchecked time arithmetic when storing backoff state. A specially crafted PRUNE control message with an extremely large backoff value, such as `u64::MAX`, can cause a Duration/Instant overflow during backoff update logic, triggering a panic in the networking state machine. This can be exploited by an attacker establishing a libp2p Gossipsub session with a target node by sending a single crafted PRUNE control message. The attack can be repeated by reconnecting and replaying the crafted control message. The **API Endpoint** involved is the Gossipsub stream. The vulnerable parameter is the backoff value within the `ControlPrune` protobuf RPC. **Recommendations** Upgrade to version 0.49.3 or later.

**Nome do Software Vulnerável e Versões Afetadas** quinn versões anteriores a 0.11.14 **Descrição** Um atacante remoto não autenticado pode causar a negação de serviço em aplicações que utilizam a implementação do protocolo de transporte QUIC quinn-proto. O problema ocorre quando um pacote QUIC Initial manipulado contendo `quic transport parameters` malformados é enviado para a aplicação. Na lógica de análise do quinn-proto, varints (inteiros de comprimento variável) controlados pelo atacante são decodificados usando a função `unwrap()`. Se as codificações estiverem truncadas, isso resulta em um `Err(UnexpectedEnd)` e causa o pânico e a queda da aplicação. Isso pode ser alcançado através da rede com um único pacote, sem a necessidade de confiança ou autenticação prévia. **Recomendações** Atualizar para a versão 0.11.14.

**Nome do Software Vulnerável e Versões Afetadas** go-ethereum (geth) versões anteriores a 1.17.0 **Descrição** Uma mensagem P2P especialmente elaborada pode levar a um alto consumo de memória. O problema afeta a implementação do protocolo Ethereum. **Recomendações** Atualize para a versão 1.17.0 ou posterior.

**Name of the Vulnerable Software and Affected Versions** Yamux versions 0.13.0 through 0.13.8 **Description** Yamux is a stream multiplexer used over reliable, ordered connections like TCP/IP. A specially crafted `WindowUpdate` can lead to an arithmetic overflow in the send-window accounting, causing a panic in the connection state machine. This is remotely exploitable over a network connection without authentication. The issue involves accepting `WindowUpdate` credit values from a remote peer and applying them to per-stream send-window state. An attacker can establish a Yamux session and crash the target by sending a sequence of frames: opening a stream and then sending a `WindowUpdate` with a large credit value that overflows a u32 integer. This results in a remote, unauthenticated denial of service. **Recommendations** Upgrade to Yamux version 0.13.9.

**Name of the Vulnerable Software and Affected Versions** Yamux versions prior to 0.13.10 **Description** Yamux is a stream multiplexer operating over reliable, ordered connections like TCP/IP. The Rust implementation of Yamux, before version 0.13.10, is susceptible to a panic when processing a specifically crafted inbound Data frame. This frame sets the SYN flag and utilizes a body length exceeding the DEFAULT CREDIT value (for example, 262145). During the initial packet of a new inbound stream, stream state is created and a receiver is queued before the validation of the oversized body completes. If validation fails, the temporary stream is dropped, and the cleanup process may call `remove(...).expect("stream not found")`, which triggers a panic within the connection state machine. This issue is remotely exploitable through a standard Yamux session without requiring authentication. The vulnerability occurs because stream state is created and a receiver is queued before oversized-body validation is complete. **Recommendations** Versions prior to 0.13.10 should be upgraded to version 0.13.10.