zaino-state Rust Crate Vulnerability: Recursive Async Function Risk
An early warning has been issued regarding a vulnerability in the zaino-state Rust crate, which reportedly contains a recursive, unbounded async function that can lead to infinite loops consuming 100% CPU. This issue is under investigation and affects the zaino-state crate.
What happened
The zaino-state Rust crate appears to have a critical vulnerability tracked as GHSA-3WHF-VGF2-9W6G. This vulnerability involves a recursive, unbounded async function that traverses parent blocks without a depth limit or cycle detection. This can potentially lead to infinite loops consuming 100% CPU if a malicious or buggy validator serves a block with a `previous_block_hash` that points back to itself.
The vulnerability is reportedly introduced in version 0 and has been addressed in version 0.4.1. It is recommended to monitor for updates to the zaino-state crate that address the identified issues. Additionally, consider implementing additional checks or limits in your usage of the `handle_reorg` function to mitigate potential risks.
For more detailed information, consult the primary source at https://github.com/zingolabs/zaino/security/advisories/GHSA-3whf-vgf2-9w6g. The severity of this issue is currently classified as HIGH, and the exact impact and exploitation details are under investigation.
How 0Day mitigates this
zaino-state is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.