N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-8wcc-m6j2-qxvm

GHSA-8wcc-m6j2-qxvm: ASA-2024-0012, ASA-2024-0013: CosmosSDK: Transaction decoding may result in a stack overflow or resource exhaustion

Summary

ASA-2024-0012

Name: ASA-2024-0012, Transaction decoding may result in a stack overflow Component: Cosmos SDK Criticality: High (Considerable Impact, and Possible Likelihood per ACMv1.2) Affected versions: cosmos-sdk versions <= v0.50.10, <= v0.47.14 Affected users: Chain Builders + Maintainers, Validators, node operators

ASA-2024-0013

Name: ASA-2024-0013: CosmosSDK: Transaction decoding may result in resource exhaustion
Component: Cosmos SDK Criticality: High (Considerable Impact, and Possible Likelihood per ACMv1.2) Affected versions: cosmos-sdk versions <= v0.50.10, <= v0.47.14 Affected users: Chain Builders + Maintainers, Validators, node operators

Impact

ASA-2024-0012

When decoding a maliciously formed packet with a deeply-nested structure, it may be possible for a stack overflow to occur and result in a network halt. This was addressed by adding a recursion limit while decoding the packet.

ASA-2024-0013

Nested messages in a transaction can consume exponential cpu and memory on UnpackAny calls. Themax_tx_bytes sets a limit for external TX but is not applied for internal messages emitted by wasm contracts or a malicious validator block. This may result in a node crashing due to resource exhaustion. This was addressed by adding additional validation to prevent this condition.

Patches

The issues above are resolved in Cosmos SDK versions v0.47.15 or v0.50.11. Please upgrade ASAP.

Timeline for ASA-2024-0012

October 1, 2024, 12:29pm UTC: Issue reported to the Cosmos Bug Bounty program
October 1, 2024, 2:47pm UTC: Issue triaged by Amulet on-call, and distributed to Core team
December 9, 2024, 11:13am UTC: Core team completes patch for issue
Dec 14, 2024,16:00 UTC: Pre-notification delivered

Miggo Vulnerability Database

→

GHSA-8wcc-m6j2-qxvm

GHSA-8wcc-m6j2-qxvm:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/cosmos/cosmos-sdk	go	>= 0.50.0-alpha.0, < 0.50.11	0.50.11
github.com/cosmos/cosmos-sdk	go	< 0.47.15	0.47.15
cosmossdk.io/x/tx	go	< 0.13.7	0.13.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerabilities stem from two key patterns: 1) The UnpackAny function's recursive message processing without depth/call limits enabled both stack overflow (CWE-674) and resource exhaustion (CWE-400). 2) The RejectUnknownFields implementations in multiple locations lacked recursion depth checks during proto field validation. The commit diffs explicitly show the addition of recursion counters (maxDepth/maxCalls in interface_registry.go) and depth-limited wrappers (doRejectUnknownFields) to address these issues. These functions were directly called during transaction decoding and Any message processing, making them the entry points for the described attacks.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-8wcc-m6j2-qxvm: ASA-2024-0012, ASA-2024-0013: CosmosSDK: Transaction decoding may result in a stack overflow or resource exhaustion

Summary

ASA-2024-0012

ASA-2024-0013

Impact

ASA-2024-0012

ASA-2024-0013

Patches

Timeline for ASA-2024-0012

GHSA-8wcc-m6j2-qxvm:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

N/A

N/A

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

GHSA-8wcc-m6j2-qxvm: ASA-2024-0012, ASA-2024-0013: CosmosSDK: Transaction decoding may result in a stack overflow or resource exhaustion

Summary

ASA-2024-0012

ASA-2024-0013

Impact

ASA-2024-0012

ASA-2024-0013

Patches

Timeline for ASA-2024-0012

Basic Information

Basic Information

Timeline for ASA-2024-0013

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI