Resource exhaustion in Kayako Samourai
CVE-2022-35913
Samourai Wallet Stonewallx2 0.99.98e allows a denial of service via a P2P coinjoin. The attacker and victim must follow each other's paynym. Then, the victim must try to collaborate with the attacker for a Stonewallx2 transaction. Next, the attacker broadcasts a tx, spending the inputs used in Stonewallx2 before the victim can broadcast the collaborative transaction. The attacker does not signal opt in RBF, and uses the lowest fee rate. This would result in the victim being unable to perform Stonewallx2. (Note that the attacker could use multiple paynyms.)
Vulnerability class: DoS (Denial of Service)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L.
EPSS exploit prediction
EPSS: 0.007 (53.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 53rd percentile — 53.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.007 · newest: 0.007 · change: +0.001
Affected products
- Kayako Samourai — versions 0.99.98e
Weakness classification (CWE)
References
- lists.linuxfoundation.org/pipermail/bitcoin-dev/2022-June/020595.html (Mailing List, Third Party Advisory)
- lists.linuxfoundation.org/pipermail/bitcoin-dev/2022-July/020737.html (Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2022-35913?
- CVE-2022-35913 is a medium-severity vulnerability in Kayako Samourai, classified under Uncontrolled Resource Consumption. CVSS score: 4.3/10. Published 2022-09-06.
- How severe is CVE-2022-35913?
- Medium severity. CVSS v3 base score is 4.3 out of 10.