Bitcoin Core Patches Three Vulnerabilities Discovered by AI Scans

Bitcoin Core has released patches for three vulnerabilities discovered through automated large language model (LLM) scans ¹²³. The vulnerabilities, identified by Elias Rohrer's Project Loupe at Spiral and surfaced by Gregory Sanders, range from medium-severity memory growth bugs to a low-severity file overflow issue ¹²³. Fixes were deployed across Bitcoin Core versions 29.5, 30.4, 31.2, and 32.1 on Oct. 27 and Oct. 28 ¹²³.

TCP Urgent Data Memory Exhaustion

The most critical of the three, rated medium severity, involves unbounded memory growth on non-Linux platforms ². A malicious peer could exploit this by sending TCP urgent (out-of-band) data to a node ². Bitcoin Core utilizes the select() backend to monitor socket events on Windows, macOS, and BSD, distinguishing it from Linux's poll() ². The select() code path monitored for exceptional conditions even when reads were paused to limit queued data ². Triggering this event prompted a read, bypassing backpressure limits and queuing unbounded data ². This vulnerability allowed malicious peers to trivially crash affected nodes ².

Unbounded Memory Growth on Paused Pre-BIP31 Peers

A second medium-severity issue addressed unbounded memory growth related to peers that do not support BIP31 ³. Bitcoin Core queues announcements, including frequent transaction INVs, for all peers, even those marked as paused due to slow reading ³. Normally, peers failing to respond to a ping within 20 minutes are disconnected, but this protocol excludes peers lacking BIP31 support ³. Malicious actors could exploit this by simulating non-support for BIP31 and delaying message reading, causing the queue to grow infinitely ³. Memory usage could expand by up to 2MB per hour per inbound peer and 5MB per hour per outbound peer ³. Nodes operating with the -blocksonly setting faced reduced risk as transaction announcements constitute the majority of queued messages ³.

Undo File Overflow

The third vulnerability, rated low severity, involves a potential undo file overflow during extreme network conditions ¹. Miners could theoretically corrupt undo data on other nodes, leading to shutdowns during specific block reorganizations or immediately upon connection on Windows and 32-bit systems ¹. Undo files, unlike block files capped at 128 MiB, have no size limit, and positions were stored as 32-bit integers ¹. By generating valid blocks with massive undo data exceeding 4 GiB, miners could cause the 32-bit position to wrap, overwriting older data ¹. If an affected block was disconnected during a reorganization, the node failed to read the undo data and shut down ¹. Restarting offered no resolution, necessitating a -reindex ¹.

Exploiting this on 64-bit systems required mining thousands of nonstandard blocks over roughly a month, alongside executing a precise reorganization ¹. The fix transitioned block and undo file positions to 64-bit integers and utilized 64-bit file positioning calls on Windows ¹. However, 32-bit systems and nodes storing blocks on FAT32 filesystems remain affected ¹.