Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
céu limpo

18 ℃

86%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 07:30:01

[USD] USD 80,626.59

[BRL] BRL 396,956.93 [USD] USD 80,626.59 [GBP] GBP 59,168.79 [EUR] EUR 68,473.82
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 07:36:40 up 229 days, 16:07, 3 users, load average: 0.00, 0.00, 0.00

[06/05/2026 21:07] Câmara aprova fundo de R$ 5 bi e controle da União sobre minerais críticos - Poder360

[06/05/2026 21:36] Trump diz "I love you" em ligação para Lula antes de reunião; veja como foi - NSC Total

[06/05/2026 12:56] Defesa de Vorcaro entrega proposta de delação à PF e PGR; entenda os próximos passos - CartaCapital

[06/05/2026 23:26] Queda de égua em adutora faz fake news sobre Copasa se espalharem nas redes - Estado de Minas

[06/05/2026 18:42] Avião transportando passageiros com hantavírus faz parada de emergência - CNN Brasil

[06/05/2026 21:39] Prisão de Thiago Ávila aprofunda crise diplomática, mas Itamaraty descarta rompimento com Israel - CartaCapital

[07/05/2026 07:03] Fabio Serapião: Ciro Nogueira é alvo de busca da PF no caso Master - UOL Notícias

[06/05/2026 15:44] Quaest: Lula lidera em Minas no primeiro turno - Estado de Minas

[06/05/2026 19:53] Brasil terá fortes rajadas de vento entre 6 e 10 de maio - Climatempo

[06/05/2026 20:06] Mulher esfaqueia cabeleireiro por corte de cabelo: 'parecendo o Cebolinha' - Correio Braziliense

[CVE-2025-11235] [Modified: 03-02-2026] [Analyzed] [V3.1 S3.7:LOW] Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.3, from 2023.0.0 before 2023.0.8, from 2022.1.0 before 2022.1.11, from 2022.0.0 before 2022.0.10.

[CVE-2025-14614] [Modified: 12-01-2026] [Analyzed] [V3.1 S6.7:MEDIUM] Insecure Temporary File vulnerability in Altera Quartus Prime Standard Installer (SFX) on Windows, Altera Quartus Prime Lite Installer (SFX) on Windows allows Explore for Predictable Temporary File Names.This issue affects Quartus Prime Standard: from 23.1 through 24.1; Quartus Prime Lite: from 23.1 through 24.1.

[CVE-2025-14631] [Modified: 12-03-2026] [Analyzed] [V3.1 S6.5:MEDIUM] A NULL Pointer Dereference vulnerability in TP-Link Archer BE400 V1(802.11 modules) allows an adjacent attacker to cause a denial-of-service (DoS) by triggering a device reboot. This issue affects Archer BE400: xi 1.1.0 Build 20250710 rel.14914.

[CVE-2025-15472] [Modified: 15-01-2026] [Analyzed] [V3.1 S7.2:HIGH] A flaw has been found in TRENDnet TEW-811DRU 1.0.2.0. This affects the function setDeviceURL of the file uapply.cgi of the component httpd . This manipulation of the argument DeviceURL causes os command injection. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2025-31962] [Modified: 12-01-2026] [Analyzed] [V3.1 S2.0:LOW] Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unauthorized access to protected API endpoints due to excessive expiration periods.

[CVE-2025-31963] [Modified: 22-01-2026] [Analyzed] [V3.1 S2.9:LOW] Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attacker to perform unauthorized configuration changes via unauthenticated administrative configuration requests.

[CVE-2025-31964] [Modified: 21-01-2026] [Analyzed] [V3.1 S2.2:LOW] Improper service binding configuration in internal service components in HCL BigFix IVR version 4.2 allows a privileged attacker to impact service availability via exposure of administrative services bound to external network interfaces instead of the local authentication interface.

[CVE-2025-47330] [Modified: 28-01-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Transient DOS while parsing video packets received from the video firmware.

[CVE-2025-47331] [Modified: 28-01-2026] [Analyzed] [V3.1 S6.1:MEDIUM] Information disclosure while processing a firmware event.

[CVE-2025-47332] [Modified: 28-01-2026] [Analyzed] [V3.1 S6.7:MEDIUM] Memory corruption while processing a config call from userspace.

[CVE-2025-47333] [Modified: 28-01-2026] [Analyzed] [V3.1 S6.6:MEDIUM] Memory corruption while handling buffer mapping operations in the cryptographic driver.

[CVE-2025-47334] [Modified: 27-01-2026] [Analyzed] [V3.1 S6.7:MEDIUM] Memory corruption while processing shared command buffer packet between camera userspace and kernel.

[CVE-2025-47335] [Modified: 27-01-2026] [Analyzed] [V3.1 S6.7:MEDIUM] Memory corruption while parsing clock configuration data for a specific hardware type.

[CVE-2025-47336] [Modified: 27-01-2026] [Analyzed] [V3.1 S6.7:MEDIUM] Memory corruption while performing sensor register read operations.

[CVE-2025-47337] [Modified: 27-01-2026] [Analyzed] [V3.1 S6.7:MEDIUM] Memory corruption while accessing a synchronization object during concurrent operations.

[CVE-2025-47339] [Modified: 27-01-2026] [Analyzed] [V3.1 S7.8:HIGH] Memory corruption while deinitializing a HDCP session.

[CVE-2025-47343] [Modified: 12-01-2026] [Analyzed] [V3.1 S7.8:HIGH] Memory corruption while processing a video session to set video parameters.

[CVE-2025-47344] [Modified: 27-01-2026] [Analyzed] [V3.1 S6.7:MEDIUM] Memory corruption while handling sensor utility operations.

[CVE-2025-47345] [Modified: 27-01-2026] [Analyzed] [V3.1 S8.4:HIGH] Cryptographic issue may occur while encrypting license data.

[CVE-2025-47346] [Modified: 27-01-2026] [Analyzed] [V3.1 S7.8:HIGH] Memory corruption while processing a secure logging command in the trusted application.