MEDIUM

GHSA-29c2-65rj-h343

Nervos CKB Permit load cell data from memory

Details

### Impact

The faulty nodes will reject transactions which calls `load_cell_data` syscall but the input cell is still in the mempool. They also ban other nodes and cause the network separation.

### Patches

0.35.2, 0.36.1, 0.37.1, 0.38.2

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/ckb

Introduced in: 0.39.0-rc1Fixed in: 0.39.0

Upgrade ckb to 0.39.0 or newer (ecosystem crates.io).

crates.io/ckb

Introduced in: 0.35.0-rc1Fixed in: 0.35.2

Upgrade ckb to 0.35.2 or newer (ecosystem crates.io).

crates.io/ckb

Introduced in: 0.36.0-rc1Fixed in: 0.36.1

Upgrade ckb to 0.36.1 or newer (ecosystem crates.io).

crates.io/ckb

Introduced in: 0.37.0-rc1Fixed in: 0.37.1

Upgrade ckb to 0.37.1 or newer (ecosystem crates.io).

crates.io/ckb

Introduced in: 0.38.0-rc1Fixed in: 0.38.2

Upgrade ckb to 0.38.2 or newer (ecosystem crates.io).

References

https://github.com/nervosnetwork/ckb/security/advisories/GHSA-29c2-65rj-h343[WEB]
https://github.com/nervosnetwork/ckb/commit/277061867eb7d2766fa6737c8bf00684fc2462a6[WEB]
https://github.com/nervosnetwork/ckb/commit/37d60d581c6713d3aca1a57018eaea45447ae0b2[WEB]
https://github.com/nervosnetwork/ckb/commit/8f115b387f8f60f938bce4591f26cd78430b8771[WEB]
https://github.com/nervosnetwork/ckb/commit/91efb7b6b4329d70d60eee91d5239a2de9b0d99f[WEB]
https://github.com/nervosnetwork/ckb/commit/97647408ee9dbf525f6c678796e770887c9f8738[WEB]