CVE-2024-38359

Vulnerability

CVE-2024-38359 is a denial-of-service (DoS) vulnerability in Lightning Network Daemon (lnd) versions prior to 0.17.0. The flaw resides in the onion processing logic, where a malicious onion packet can trigger excessive memory allocation, leading to an out-of-memory (OOM) condition and node crash [1]. The issue stems from improper handling of variable-length fields during decoding of hop payloads [1].

Exploitation

An attacker can exploit this vulnerability by crafting a specially designed onion packet and sending it to a victim node via the Lightning Network. Because the packet is onion-routed, the attacker does not need a direct connection to the victim, making the source difficult to trace [1]. The attack is cheap and easy to carry out, and it can keep the victim offline for as long as the attack lasts [1].

Impact

Successful exploitation causes the vulnerable node to run out of memory and crash, disrupting its ability to process payments, forward HTLCs, or participate in the network. This DoS can lead to financial loss if the node is unable to settle or forward payments in a timely manner [1]. All nodes running unpatched versions are vulnerable [1].

Mitigation

The vulnerability is patched in lnd v0.17.0 [2]. Users should upgrade to version 0.17.0 or later. For those unable to upgrade, mitigations include setting the --rejecthtlc CLI flag, disabling forwarding via UpdateChanPolicyCommand, or disabling public network listening with --nolisten [3].