HexBrain

Linux Foundation Decentralized Trust · Report #1604951

Remote denial of service in HyperLedger Fabric

Validstatus
highseverity
32upvotes
7 Jul 2022disclosed

Summary

This issue was caused by a missing check of nil.

An orderer to orderer consensus message that contains an empty inner message crashes the node because it attempts to figure out its type and the mere action of determining the type of a nil pointer, causes a panic.

Thank you to Haosheng Wang of OPPO ZIWU Security Lab for this disclosure.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original