CVE-2018-10058

Vulnerability

The remote management interface in cgminer 4.10.0 and bfgminer 5.5.0 (and earlier versions) contains a stack-based buffer overflow (CWE-121) in the handlers for the addpool, failover-only, poolquota, and save commands. The vulnerability arises because user-supplied input is copied into fixed-size stack buffers without proper bounds checking. Both miners share a common code base, so both are affected [1][2].

Exploitation

An attacker must first authenticate to the remote management interface. Once authenticated, they can send crafted requests to the vulnerable command handlers. The PoC demonstrates sending an oversized argument to the addpool command, which overflows the stack buffer and overwrites the return address. No user interaction beyond authentication is required; the attack is network-based [1].

Impact

Successful exploitation allows an authenticated remote attacker to execute arbitrary code with the privileges of the miner process. This can lead to full compromise of the mining system, including data exfiltration, installation of malware, or disruption of mining operations. The impact is high as it provides code execution on the target [1][2].

Mitigation

As of the publication date (2018-06-05), no official patches have been released for either cgminer or bfgminer. The latest versions (4.10.0 and 5.5.0) remain vulnerable. Users are advised to restrict access to the remote management interface to trusted networks only, or disable it if not required. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog [1][2].