full-disclosure - [FD] Monero 18.3.4 zero-day DoS vulnerability has been dropped publicly on social network.

Open Source and information security mailing list archives

Message-ID: <o4VBFvedVzm8gGMZGn5k2Q0FEIY06FrYezmpt-ibK6IkMD13NLqtUBtqgQ_ZJHgUJzjaqyNEdzkrW8PnUBHGj_Ood3_KT251t3ro9rP95EY=@proton.me>
Date: Fri, 14 Feb 2025 01:31:53 +0000
From: "upper.underflow via Fulldisclosure" <fulldisclosure@...lists.org>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] Monero 18.3.4 zero-day DoS vulnerability has been dropped
	publicly on social network.

Hello,

About an hour ago, a group appearing to be named WyRCV2 posted a note on the nostr social network, which can be found at the following link: https://primal.net/e/note1vzh0mj9rcxax9cgcdapupyxeehjprd68gd9kk9wrv939m8knulrs4780x7

>Monero Zero-day vulnerability and exploit
>
>Take down the XMR network with us, make the future a better a place.
Save, share, use.
>
>https:[//]anonpaste.org/?cccb7639afbd0650#HaMQAfzFdCqMDh9MwNuGRGUBXLgtk5yHWdAzS7MbvEVN

The paste link includes a list of nodes that the attacker has instructed to target, along with a Python code to leverage the attack. According to their explanation, this vulnerability is expected to be patched in the next release of Monero. Any Monero node that exposes its RPC port is vulnerable to memory exhaustion.

I can confirm that the Python code works and using it against a test node leads to a crash due to memory exhaustion. The code is extremely simple, as it spams requests without attempting to read responses, causing Monero to keep them indefinitely in memory until a crash occurs.

The attackers claim to have taken down 8 public nodes and 1 seed node, which is used as a rendezvous point for new nodes to connect to the network.
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives