Vulnerability Details : CVE-2023-42448
Hydra is the layer-two scalability solution for Cardano. Prior to version 0.13.0, the specification states that the contestation period in the datum of the UTxO at the head validator must stay unchanged as the state progresses from Open to Closed (Close transaction), but no such check appears to be performed in the `checkClose` function of the head validator. This would allow a malicious participant to modify the contestation deadline of the head to either allow them to fanout the head without giving another participant the chance to contest, or prevent any participant from ever redistributing the funds locked in the head via a fan-out. Version 0.13.0 contains a patch for this issue.
Vulnerability category: Input validation
Products affected by CVE-2023-42448
- cpe:2.3:a:iohk:hydra:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-42448
0.10%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 42 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-42448
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
8.1
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H |
2.8
|
5.2
|
NIST | |
|
8.1
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H |
2.8
|
5.2
|
GitHub, Inc. |
CWE ids for CVE-2023-42448
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: security-advisories@github.com (Secondary)
-
The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.Assigned by: nvd@nist.gov (Primary)
References for CVE-2023-42448
-
https://github.com/input-output-hk/hydra/commit/2f45529729e28254a62f7a7c8d6649066923ed1f
Ensure close transaction does not change contestation period · input-output-hk/hydra@2f45529 · GitHubPatch
-
https://github.com/input-output-hk/hydra/blob/master/hydra-plutus/src/Hydra/Contract/Head.hs#L284-L296
hydra/hydra-plutus/src/Hydra/Contract/Head.hs at master · input-output-hk/hydra · GitHubProduct
-
https://github.com/input-output-hk/hydra/security/advisories/GHSA-mgcx-6p7h-5996
Contestation period in head datum can be modified during Close transaction, allowing malicious participant to freely modify the contestation deadline · Advisory · input-output-hk/hydra · GitHubVendor Advisory
-
https://github.com/input-output-hk/hydra/blob/master/CHANGELOG.md#0130---2023-10-03
hydra/CHANGELOG.md at master · input-output-hk/hydra · GitHubRelease Notes
-
https://github.com/input-output-hk/hydra/blob/master/hydra-plutus/src/Hydra/Contract/Head.hs#L320-L323
hydra/hydra-plutus/src/Hydra/Contract/Head.hs at master · input-output-hk/hydra · GitHubProduct
Jump to