CVE-2024-38365: 
NixOS vulnerability analysis and mitigation

A critical vulnerability in btcd (CVE-2024-38365), discovered in versions prior to 0.24.2, stems from an incorrect implementation of Bitcoin Core's FindAndDelete functionality. The vulnerability, introduced in 2014, affects the consensus rules for legacy signature verification in the Bitcoin protocol. This flaw has been assigned a CVSS score of 7.4 and was discovered by researchers Niklas Gögge and Antoine Poinsot (SecurityOnline, GitHub Advisory).

The vulnerability lies in btcd's implementation of the removeOpcodeByData function, which handles signature verification differently from Bitcoin Core's FindAndDelete function. While Bitcoin Core's implementation only removes exact matches of signatures from the script, btcd's removeOpcodeByData removes any data push containing the signature, even with additional padding data. This discrepancy allows for the creation of transactions that appear valid to Bitcoin Core nodes but are rejected by vulnerable btcd nodes (SecurityOnline).

The vulnerability could allow attackers to create a hard fork of the Bitcoin blockchain at minimal cost. Malicious actors could force vulnerable btcd nodes into a forked chain, leading to network instability and transaction processing issues. The bug can be exploited remotely by any Bitcoin user without requiring hash power (GitHub Advisory).

The vulnerability has been patched in btcd version 0.24.2. All users running affected versions are strongly encouraged to update to the latest version to prevent potential exploitation (ASEC, GitHub Release).