Bitcoin Core patches node-crash flaw found by Block's AI
A flaw found by Block's AI lets a malicious peer crash Bitcoin Core nodes on Windows, macOS and BSD by sending TCP urgent data that slips past the memory limit until the node runs out and crashes. Linux is not affected. Fixes shipped in versions 29.5, 30.4, 31.2 and 32.1; update the node.
What happened
Bitcoin Core patched and disclosed a flaw that lets a malicious network peer crash nodes on Windows, macOS and BSD. An AI from Jack Dorsey's Block found the issue. The fix went public 5 days after the AI flagged it.
Why it matters
Nodes on those systems can run out of memory and crash, halting transaction validation until restart. Linux nodes are not affected.
What to do
Update Bitcoin Core to 29.5, 30.4, 31.2 or 32.1 now. Check for any nodes still on old versions running Windows, macOS or BSD.
For the technical team
- Affected
- Bitcoin Core · Bitcoin Core nodes on Windows, macOS and BSD. Linux is not affected.
- Exploitation
- No exploitation reported in the sources. The fix went public 5 days after Block's AI flagged the flaw.
- Fix
- Bitcoin Core versions 29.5, 30.4, 31.2 and 32.1.
- Vector
- Bitcoin Core. A malicious peer sends TCP urgent data that slips past the node's memory limit until memory runs out and the node crashes. Remote denial of service over the P2P network, no login required.
- More details
- Flaw found by AI from Jack Dorsey's Block. Per the source, since 22 October bugs an LLM can easily find are fixed and disclosed as soon as possible; previously, medium-severity bugs stayed secret for about a year.
Timeline
Bitcoin Core discloses and patches node crash flaw found with Block's AI.
Sources 1 source
- @IntCyberDigest @IntCyberDigest
