Miggo Logo

CVE-2021-4239: Noise vulnerable to denial of service

7.7

CVSS Score
3.1

Basic Information

EPSS Score
0.25832%
Published
12/28/2022
Updated
2/9/2023
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/flynn/noisego< 1.0.01.0.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

  1. The commit diff explicitly shows the vulnerable Decrypt function in state.go was modified to fix nonce increment-on-failure behavior. 2. Vulnerability descriptions specifically mention Encrypt's nonce wrap-around issue, and the Go vulnerability report (GO-2022-0425) lists CipherState.Encrypt as an affected symbol. 3. Both functions manage nonce state - Encrypt through incremental counter, Decrypt through state synchronization - making them the logical points of failure for the described issues.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

Nois* is * *o impl*m*nt*tion o* t** Nois* Proto*ol *r*m*work. T** Nois* proto*ol impl*m*nt*tion su***rs *rom w**k*n** *rypto*r*p*i* s**urity **t*r *n*ryptin* *^** m*ss***s, *n* * pot*nti*l **ni*l o* s*rvi** *tt**k. **t*r *^** (~**.* quintillion) m*ss

Reasoning

*. T** *ommit *i** *xpli*itly s*ows t** vuln*r**l* ***rypt *un*tion in st*t*.*o w*s mo*i*i** to *ix non** in*r*m*nt-on-**ilur* ****vior. *. Vuln*r**ility **s*riptions sp**i*i**lly m*ntion *n*rypt's non** wr*p-*roun* issu*, *n* t** *o vuln*r**ility r*