Zebra P2P Sync Peer Ban Evasion via FindBlocks Hash Mismatch (CWE-345)

Vulnerability Overview Title: Far-ahead FindBlocks hashes cause Zebra to ban honest peers that serve requested blocks Description: A connected remote peer can cause a syncing Zebra node to ban honest peers that correctly provide the blocks requested by the node. The attacker returns real, far-ahead block hashes in the response. Zebra loses track of which peer provided these hashes, downloads the blocks from other peers, and then penalizes the peers that served these blocks. Repeating this behavior erodes the set of available peers for Zebra and triggers sync disruption and eclipse risks. Consensus rules are not bypassed, and far-ahead blocks are still dropped. Impact Scope Affected Versions: v4.5.0 to v6.2.3 Fixed Version: 6.3.0 Severity: Medium CVSS 3.1: 4.8 (Medium) Conditions: Potential impact occurs if the node is running Zebra v4.5.0 through v6.2.3, the node is more than 50,000 blocks behind the network tip (typically occurring during initial block download or extended outages), and the node accepts inbound peer connections or connects to peers capable of responding to . Remediation Patch: The recommended fix in version 6.3.0 involves continuing to drop far-ahead blocks within the case, but ceasing to send false misbehavior points to the peer that served them. The existing code path is retained to handle invalid blocks via the and paths. A stronger future fix will store the source peer for each hash and verify that downloaded blocks correspond to the requested locator, accounting for ambiguity between responses and unsolicited gossip. Additional Information Reporter: zakura-security References: - CWE-345: https://cwe.mitre.org/data/definitions/345.html - Permanent link to fixed source (exact lines to be inserted prior to final release) - Related: GHSA-g5th (Peer false misbehavior in sync download scoring path; opposite direction) Code Snippet

Goal Reached Thanks to every supporter — we hit 100%!

Zebra P2P Sync Peer Ban Evasion via FindBlocks Hash Mismatch (CWE-345)

More from this source