Discussing Pre-0.21.0 Bitcoin Core Vulnerability Disclosures

Brink engineers Gloria Zhao and Niklas Gögge talk through the recently disclosed Bitcoin Core pre-0.21.0 vulnerabilities.

• (0:00) - Introductions and motivation for disclosures
• (3:17) - Absolute value of a signed integer leads to rejection of all blocks
• (13:50) - Too many misbehaving peers leads to DoS
• (21:17) - Nested loop without deduplication leads to stalling
• (27:34) - Vulnerability in dependency leads to potential RCE
• (34:17) - Large memory allocation in peer receiver buffer and send buffer
• (35:41) - Payment request fetch causes mysterious crashing
• (37:39) - Misordered logic permits download of blocks bypassing checkpoints
• (42:21) - Lessons learned from these disclosures