CVE-2022-29177: 
Ethereum Geth vulnerability analysis and mitigation

Go Ethereum (geth), the official Golang implementation of the Ethereum protocol, was found to contain a vulnerability (CVE-2022-29177) that could allow an attacker to crash nodes configured with high verbosity logging through specially crafted p2p messages. The vulnerability was discovered and reported by nrv via bounty@ethereum.org, affecting versions prior to 1.10.17, with the fix being implemented in version 1.10.17 (GitHub Advisory).

The vulnerability stems from the implementation of disconnect reason handling in the p2p protocol. The issue was related to how disconnect reasons were stored, where other implementations used a single byte for storage. The vulnerability was assigned a CVSS v3.1 Base Score of 5.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating network accessibility with high attack complexity and potential for high availability impact (NVD).

When exploited, the vulnerability could cause a denial of service (DoS) condition by crashing nodes that were configured with high verbosity logging. The impact was limited to availability, with no compromise to confidentiality or integrity of the affected systems (GitHub Advisory).

The vulnerability was patched in Go Ethereum version 1.10.17 through PR #24507, which modified the DiscReason type to uint8. As a workaround, users can set the loglevel to the default level (INFO) to prevent exploitation of this vulnerability (GitHub Advisory).