CVE-2024-52922: bitcoin core — Fix

Description

In Bitcoin Core before 25.1, an attacker can cause a node to not download the latest block, because there can be minutes of delay when an announcing peer stalls instead of complying with the peer-to-peer protocol specification.

Is your site exposed to CVE-2024-52922?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected Products

Vendor	Product	Versions
bitcoin	bitcoin_core	< 25.1

References

Advisories & Patches

https://bitcoincore.org/en/2024/11/05/cb-stall-hindering-propagation/

Other References

https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures

Frequently Asked Questions

What is CVE-2024-52922? +

In Bitcoin Core before 25.1, an attacker can cause a node to not download the latest block, because there can be minutes of delay when an announcing peer stalls instead of complying with the peer-to-peer protocol specification. It has a CVSS v3.1 base score of 6.5 (MEDIUM).

How severe is CVE-2024-52922? +

CVE-2024-52922 has a CVSS v3.1 score of 6.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-52922? +

CVE-2024-52922 affects products from bitcoin, specifically: bitcoin_core. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-52922? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2019-25220 7.5

Bitcoin Core before 24.0.1 allows remote attackers to cause a denial of service (daemon crash) via a flood of low-difficulty …

CVE-2024-52912 7.5

Bitcoin Core before 0.21.0 allows a network split that is resultant from an integer overflow (calculating the time offset for …

CVE-2024-52914 7.5

In Bitcoin Core before 0.18.0, a node could be stalled for hours when processing the orphans of a crafted unconfirmed …

CVE-2024-52915 7.5

Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (memory consumption) via a crafted INV message.

CVE-2024-52916 7.5

Bitcoin Core before 0.15.0 allows a denial of service (OOM kill of a daemon process) via a flood of minimum …

CVE-2024-52920 7.5

Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (infinite loop) via a malformed GETDATA message.

CVE-2024-52922