Skip to content

Commit 15339cf

Browse files
holimanfjl
holiman
and
fjl
authored
cmd/geth: implement vulnerability check (#21859)
* cmd/geth: implement vulnerability check * cmd/geth: use minisign to verify vulnerability feed * cmd/geth: add the test too * cmd/geth: more minisig/signify testing * cmd/geth: support multiple pubfiles for signing * cmd/geth: add @holiman minisig pubkey * cmd/geth: polishes on vulnerability check * cmd/geth: fix ineffassign linter nit * cmd/geth: add CVE to version check struct * cmd/geth/testdata: add missing testfile * cmd/geth: add more keys to versionchecker * cmd/geth: support file:// URLs in version check * cmd/geth: improve key ID printing when signature check fails Co-authored-by: Felix Lange <[email protected]>
1 parent 7770e41 commit 15339cf

17 files changed

+433
-0
lines changed

‎cmd/geth/main.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -242,6 +242,7 @@ func init() {
242242
makecacheCommand,
243243
makedagCommand,
244244
versionCommand,
245+
versionCheckCommand,
245246
licenseCommand,
246247
// See config.go
247248
dumpConfigCommand,

‎cmd/geth/misccmd.go‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,18 @@ import (
3131
)
3232

3333
var (
34+
VersionCheckUrlFlag = cli.StringFlag{
35+
Name: "check.url",
36+
Usage: "URL to use when checking vulnerabilities",
37+
Value: "https://geth.ethereum.org/docs/vulnerabilities/vulnerabilities.json",
38+
}
39+
VersionCheckVersionFlag = cli.StringFlag{
40+
Name: "check.version",
41+
Usage: "Version to check",
42+
Value: fmt.Sprintf("Geth/v%v/%v-%v/%v",
43+
params.VersionWithCommit(gitCommit, gitDate),
44+
runtime.GOOS, runtime.GOARCH, runtime.Version()),
45+
}
3446
makecacheCommand = cli.Command{
3547
Action: utils.MigrateFlags(makecache),
3648
Name: "makecache",
@@ -65,6 +77,21 @@ Regular users do not need to execute it.
6577
Category: "MISCELLANEOUS COMMANDS",
6678
Description: `
6779
The output of this command is supposed to be machine-readable.
80+
`,
81+
}
82+
versionCheckCommand = cli.Command{
83+
Action: utils.MigrateFlags(versionCheck),
84+
Flags: []cli.Flag{
85+
VersionCheckUrlFlag,
86+
VersionCheckVersionFlag,
87+
},
88+
Name: "version-check",
89+
Usage: "Checks (online) whether the current version suffers from any known security vulnerabilities",
90+
ArgsUsage: "<versionstring (optional)>",
91+
Category: "MISCELLANEOUS COMMANDS",
92+
Description: `
93+
The version-check command fetches vulnerability-information from https://geth.ethereum.org/docs/vulnerabilities/vulnerabilities.json,
94+
and displays information about any security vulnerabilities that affect the currently executing version.
6895
`,
6996
}
7097
licenseCommand = cli.Command{

‎cmd/geth/testdata/vcheck/data.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
[
2+
{
3+
"name": "CorruptedDAG",
4+
"uid": "GETH-2020-01",
5+
"summary": "Mining nodes will generate erroneous PoW on epochs > `385`.",
6+
"description": "A mining flaw could cause miners to erroneously calculate PoW, due to an index overflow, if DAG size is exceeding the maximum 32 bit unsigned value.\n\nThis occurred on the ETC chain on 2020-11-06. This is likely to trigger for ETH mainnet around block `11550000`/epoch `385`, slated to occur early January 2021.\n\nThis issue is relevant only for miners, non-mining nodes are unaffected, since non-mining nodes use a smaller verification cache instead of a full DAG.",
7+
"links": [
8+
"https://github.com/ethereum/go-ethereum/pull/21793",
9+
"https://blog.ethereum.org/2020/11/12/geth_security_release/",
10+
"https://github.com/ethereum/go-ethereum/commit/567d41d9363706b4b13ce0903804e8acf214af49"
11+
],
12+
"introduced": "v1.6.0",
13+
"fixed": "v1.9.24",
14+
"published": "2020-11-12",
15+
"severity": "Medium",
16+
"check": "Geth\\/v1\\.(6|7|8)\\..*|Geth\\/v1\\.9\\.2(1|2|3)-.*"
17+
},
18+
{
19+
"name": "GoCrash",
20+
"uid": "GETH-2020-02",
21+
"summary": "A denial-of-service issue can be used to crash Geth nodes during block processing, due to an underlying bug in Go (CVE-2020-28362) versions < `1.15.5`, or `<1.14.12`",
22+
"description": "The DoS issue can be used to crash all Geth nodes during block processing, the effects of which would be that a major part of the Ethereum network went offline.\n\nOutside of Go-Ethereum, the issue is most likely relevant for all forks of Geth (such as TurboGeth or ETC’s core-geth) which is built with versions of Go which contains the vulnerability.",
23+
"links": [
24+
"https://blog.ethereum.org/2020/11/12/geth_security_release/",
25+
"https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM",
26+
"https://github.com/golang/go/issues/42552"
27+
],
28+
"fixed": "v1.9.24",
29+
"published": "2020-11-12",
30+
"severity": "Critical",
31+
"check": "Geth.*\\/go1\\.(11(.*)|12(.*)|13(.*)|14|14\\.(\\d|10|11|)|15|15\\.[0-4])$"
32+
},
33+
{
34+
"name": "ShallowCopy",
35+
"uid": "GETH-2020-03",
36+
"summary": "A consensus flaw in Geth, related to `datacopy` precompile",
37+
"description": "Geth erroneously performed a 'shallow' copy when the precompiled `datacopy` (at `0x00...04`) was invoked. An attacker could deploy a contract that uses the shallow copy to corrupt the contents of the `RETURNDATA`, thus causing a consensus failure.",
38+
"links": [
39+
"https://blog.ethereum.org/2020/11/12/geth_security_release/"
40+
],
41+
"introduced": "v1.9.7",
42+
"fixed": "v1.9.17",
43+
"published": "2020-11-12",
44+
"severity": "Critical",
45+
"check": "Geth\\/v1\\.9\\.(7|8|9|10|11|12|13|14|15|16).*$"
46+
},
47+
{
48+
"name": "GethCrash",
49+
"uid": "GETH-2020-04",
50+
"summary": "A denial-of-service issue can be used to crash Geth nodes during block processing",
51+
"description": "Full details to be disclosed at a later date",
52+
"links": [
53+
"https://blog.ethereum.org/2020/11/12/geth_security_release/"
54+
],
55+
"introduced": "v1.9.16",
56+
"fixed": "v1.9.18",
57+
"published": "2020-11-12",
58+
"severity": "Critical",
59+
"check": "Geth\\/v1\\.9.(16|17).*$"
60+
}
61+
]

‎cmd/geth/testdata/vcheck/data2.json‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
[
2+
{
3+
"name": "CorruptedDAG",
4+
"uid": "GETH-2020-01",
5+
"summary": "Mining nodes will generate erroneous PoW on epochs > `385`.",
6+
"description": "A mining flaw could cause miners to erroneously calculate PoW, due to an index overflow, if DAG size is exceeding the maximum 32 bit unsigned value.\n\nThis occurred on the ETC chain on 2020-11-06. This is likely to trigger for ETH mainnet around block `11550000`/epoch `385`, slated to occur early January 2021.\n\nThis issue is relevant only for miners, non-mining nodes are unaffected, since non-mining nodes use a smaller verification cache instead of a full DAG.",
7+
"links": [
8+
"https://github.com/ethereum/go-ethereum/pull/21793",
9+
"https://blog.ethereum.org/2020/11/12/geth_security_release/",
10+
"https://github.com/ethereum/go-ethereum/commit/567d41d9363706b4b13ce0903804e8acf214af49"
11+
],
12+
"introduced": "v1.6.0",
13+
"fixed": "v1.9.24",
14+
"published": "2020-11-12",
15+
"severity": "Medium",
16+
"check": "Geth\\/v1\\.(6|7|8)\\..*|Geth\\/v1\\.9\\.2(1|2|3)-.*",
17+
"CVE": "correct"
18+
},
19+
{
20+
"name": "GoCrash",
21+
"uid": "GETH-2020-02",
22+
"summary": "A denial-of-service issue can be used to crash Geth nodes during block processing, due to an underlying bug in Go (CVE-2020-28362) versions < `1.15.5`, or `<1.14.12`",
23+
"description": "The DoS issue can be used to crash all Geth nodes during block processing, the effects of which would be that a major part of the Ethereum network went offline.\n\nOutside of Go-Ethereum, the issue is most likely relevant for all forks of Geth (such as TurboGeth or ETC’s core-geth) which is built with versions of Go which contains the vulnerability.",
24+
"links": [
25+
"https://blog.ethereum.org/2020/11/12/geth_security_release/",
26+
"https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM",
27+
"https://github.com/golang/go/issues/42552"
28+
],
29+
"fixed": "v1.9.24",
30+
"published": "2020-11-12",
31+
"severity": "Critical",
32+
"check": "Geth.*\\/go1\\.(11(.*)|12(.*)|13(.*)|14|14\\.(\\d|10|11|)|15|15\\.[0-4])$"
33+
},
34+
{
35+
"name": "ShallowCopy",
36+
"uid": "GETH-2020-03",
37+
"summary": "A consensus flaw in Geth, related to `datacopy` precompile",
38+
"description": "Geth erroneously performed a 'shallow' copy when the precompiled `datacopy` (at `0x00...04`) was invoked. An attacker could deploy a contract that uses the shallow copy to corrupt the contents of the `RETURNDATA`, thus causing a consensus failure.",
39+
"links": [
40+
"https://blog.ethereum.org/2020/11/12/geth_security_release/"
41+
],
42+
"introduced": "v1.9.7",
43+
"fixed": "v1.9.17",
44+
"published": "2020-11-12",
45+
"severity": "Critical",
46+
"check": "Geth\\/v1\\.9\\.(7|8|9|10|11|12|13|14|15|16).*$"
47+
},
48+
{
49+
"name": "GethCrash",
50+
"uid": "GETH-2020-04",
51+
"summary": "A denial-of-service issue can be used to crash Geth nodes during block processing",
52+
"description": "Full details to be disclosed at a later date",
53+
"links": [
54+
"https://blog.ethereum.org/2020/11/12/geth_security_release/"
55+
],
56+
"introduced": "v1.9.16",
57+
"fixed": "v1.9.18",
58+
"published": "2020-11-12",
59+
"severity": "Critical",
60+
"check": "Geth\\/v1\\.9.(16|17).*$"
61+
}
62+
]

‎cmd/geth/testdata/vcheck/minisig-sigs/vulnerabilities.json.minisig.1‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
untrusted comment: signature from minisign secret key
2+
RWQkliYstQBOKFQFQTjmCd6TPw07VZyWFSB3v4+1BM1kv8eHLE5FDy2OkPEqtdaL53xftlrHoJQie0uCcovdlSV8kpyxiLrxEQ0=
3+
trusted comment: timestamp:1605618622 file:vulnerabilities.json
4+
osAPs4QPdDkmiWQxqeMIzYv/b+ZGxJ+19Sbrk1Cpq4t2gHBT+lqFtwL3OCzKWWyjGRTmHfsVGBYpzEdPRQ0/BQ==

‎cmd/geth/testdata/vcheck/minisig-sigs/vulnerabilities.json.minisig.2‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
untrusted comment: Here's a comment
2+
RWQkliYstQBOKFQFQTjmCd6TPw07VZyWFSB3v4+1BM1kv8eHLE5FDy2OkPEqtdaL53xftlrHoJQie0uCcovdlSV8kpyxiLrxEQ0=
3+
trusted comment: Here's a trusted comment
4+
3CnkIuz9MEDa7uNyGZAbKZhuirwfiqm7E1uQHrd2SiO4Y8+Akw9vs052AyKw0s5nhbYHCZE2IMQdHNjKwxEGAQ==

‎cmd/geth/testdata/vcheck/minisig-sigs/vulnerabilities.json.minisig.3‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
untrusted comment: One more (untrusted) comment
2+
RWQkliYstQBOKFQFQTjmCd6TPw07VZyWFSB3v4+1BM1kv8eHLE5FDy2OkPEqtdaL53xftlrHoJQie0uCcovdlSV8kpyxiLrxEQ0=
3+
trusted comment: Here's a trusted comment
4+
3CnkIuz9MEDa7uNyGZAbKZhuirwfiqm7E1uQHrd2SiO4Y8+Akw9vs052AyKw0s5nhbYHCZE2IMQdHNjKwxEGAQ==

‎cmd/geth/testdata/vcheck/minisign.pub‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
untrusted comment: minisign public key 284E00B52C269624
2+
RWQkliYstQBOKOdtClfgC3IypIPX6TAmoEi7beZ4gyR3wsaezvqOMWsp

‎cmd/geth/testdata/vcheck/minisign.sec‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
untrusted comment: minisign encrypted secret key
2+
RWRTY0Iyz8kmPMKrqk6DCtlO9a33akKiaOQG1aLolqDxs52qvPoAAAACAAAAAAAAAEAAAAAArEiggdvyn6+WzTprirLtgiYQoU+ihz/HyGgjhuF+Pz2ddMduyCO+xjCHeq+vgVVW039fbsI8hW6LRGJZLBKV5/jdxCXAVVQE7qTQ6xpEdO0z8Z731/pV1hlspQXG2PNd16NMtwd9dWw=

‎cmd/geth/testdata/vcheck/signify-sigs/data.json.sig‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
untrusted comment: verify with ./signifykey.pub
2+
RWSKLNhZb0KdAbhRUhW2LQZXdnwttu2SYhM9EuC4mMgOJB85h7/YIPupf8/ldTs4N8e9Y/fhgdY40q5LQpt5IFC62fq0v8U1/w8=

0 commit comments

Comments
 (0)