Vulnerability · Published Nov 25, 2020 · Assigned by GitHub_M

CVE-2020-26240Erroneous Proof of Work calculation in geth

Medium 5.3

In plain English

A medium-severity security flaw in go-ethereum from ethereum. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 79% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)1.9%top 20.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. An ethash mining DAG generation flaw in Geth before version 1.9.24 could cause miners to erroneously calculate PoW in an upcoming epoch (estimated early January, 2021). This happened on the ETC chain on 2020-11-06. This issue is relevant only for miners, non-mining nodes are unaffected. This issue is fixed as of 1.9.24

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/ethereum/go-ethereum	1.9.24	GHSA-v592-xf75-856p
Go	github.com/ethereum/go-ethereum	1.9.24	GO-2022-0775

Affected products (as reported)

Vendor	Product	Versions
ethereum	go-ethereum	< 1.9.24

Weakness: CWE-682 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

References

https://blog.ethereum.org/2020/11/12/geth_security_release/ x_refsource_MISC
https://github.com/ethereum/go-ethereum/security/advisories/GHSA-v592-xf75-856p x_refsource_CONFIRM
https://github.com/ethereum/go-ethereum/pull/21793 x_refsource_MISC
https://github.com/ethereum/go-ethereum/commit/d990df909d7839640143344e79356754384dcdd0 x_refsource_MISC