Hello,
About an hour ago, a group appearing to be named Hello,
About an hour ago, a group appearing to be named WyRCV2 posted a note on the nostr social network, which can be found at the following link: https://primal.net/e/note1vzh0mj9rcxax9cgcdapupyxeehjprd68gd9kk9wrv939m8knulrs4780x7
>Monero Zero-day vulnerability and exploit
>
>Take down the XMR network with us, make the future a better a place.
Save, share, use.
>
>https:[//]anonpaste.org/?cccb7639afbd0650#HaMQAfzFdCqMDh9MwNuGRGUBXLgtk5yHWdAzS7MbvEVN
The paste link includes a list of nodes that the attacker has instructed to target, along with a Python code to leverage the attack. According to their explanation, this vulnerability is expected to be patched in the next release of Monero. Any Monero node that exposes its RPC port is vulnerable to memory exhaustion.
I can confirm that the Python code works and using it against a test node leads to a crash due to memory exhaustion. The code is extremely simple, as it spams requests without attempting to read responses, causing Monero to keep them indefinitely in memory until a crash occurs.
The attackers claim to have taken down 8 public nodes and 1 seed node, which is used as a rendezvous point for new nodes to connect to the network.