GHSA-r3r4-g7hq-pq4f: 
vulnerability analysis and mitigation

A high-severity vulnerability (GHSA-r3r4-g7hq-pq4f) was identified in CometBFT that allows a malicious peer to stall the network by disseminating seemingly valid block parts. The vulnerability affects versions <= v0.38.16 and v1.0.0, and was discovered on January 15, 2025. The issue was patched in versions v0.38.17 and v1.0.1 (GitHub Advisory).

The vulnerability stems from insufficient validation of block part indices and corresponding proof part indices in CometBFT. When a proposer creates a block, it's split into 64kB block parts, each containing an Index, Bytes, and Proof fields. The critical flaw was that CometBFT did not validate that Part.Index must equal Part.Proof.Index, allowing attackers to use proofs from different parts that CometBFT would accept as valid, even though the proof verified a different piece of the proposed block (GitHub Advisory).

This vulnerability has two major impacts: first, it causes the dissemination of invalid block parts to neighboring nodes as they are incorrectly deemed correct; second, it marks these invalid block parts as received and instructs neighboring nodes not to relay them, making it impossible to receive the correct block parts. This can ultimately lead to a network halt (GitHub Advisory).

There are no known workarounds for this vulnerability. The only mitigation is to upgrade to CometBFT versions v0.38.17 or v1.0.1, which include patches that verify Part.Index equals Part.Proof.Index. After upgrading, validators will eventually conclude the correct value (GitHub Advisory).