Bitcoin Core, the software most bitcoin nodes run, disclosed three bugs on Wednesday and rated every one of them “easily discoverable”. That is the label its new security policy uses for bugs it fixes straight away rather than holding under embargo.
All three were found by an automated scan using a large language model (LLM), run in Elias Rohrer’s Project Loupe at Spiral, according to the disclosures. Gregory Sanders validated the findings and passed them to the Bitcoin Core team.
The fixes are in four point releases, small updates to each supported version: 31.2 and 32.1 came out on 27 Oct, and 29.5 and 30.4 on 28 Oct. If you run a node on any of those lines, the advice is simply to upgrade.
The three bugs
A peer is another node yours is connected to. Two of the bugs let a hostile peer make your node use more and more memory until it runs out.
The serious one is for Windows, macOS and BSD. On those systems Bitcoin Core watches its connections with an older mechanism called select(). A peer could abuse a little-used TCP feature, “urgent data”, to make memory grow without limit. “A malicious peer can trivially crash any Windows, macOS or BSD node it is connected to,” the disclosure says. Linux nodes use a different mechanism and are not affected. It is rated Medium.
That one moved quickly. Project Loupe flagged it on 23 Oct. Antoine Poinsot opened and merged the fix on 26 Oct, and the first releases shipped the next day.
The slow one affects everyone, a little. Nodes normally disconnect a peer that does not answer a “ping” within 20 minutes. Peers that claim to predate that ping rule were exempt, so one could stall and let a queue of messages build up. Memory could grow by up to 2MB an hour per inbound peer and 5MB per outbound peer, according to the disclosure. Nodes run with -blocksonly are much less affected. Medium again.
The third is close to theoretical. A reorg is when the chain’s latest blocks are swapped for a competing set. Bitcoin Core stored positions in its “undo” files, which it needs to reverse blocks, as 32-bit numbers that wrap around past 4 GiB (2 GiB on Windows and 32-bit systems). Triggering it would need several thousand nonstandard blocks, roughly a month of the whole network’s output, plus control over how block files are laid out and a two-block reorg, the project says. The node would shut down and need a -reindex. It is rated Low. 32-bit systems and nodes storing blocks on FAT32 drives remain affected even after the fix.
None of the disclosures says the bugs were used against anyone.
What this does to my base case
Last week I set out the new policy, which I wrote about last week and called my base case the short fuse: more fixes would arrive as point releases with advisories, fewer would wait quietly for a major version.
I also said what would change my mind. A run of point releases flagged as easily discoverable would confirm it.
Five days after that piece, we have four point releases and three disclosures, every one carrying that label. That is the confirmation I said I was looking for, sooner than I expected.
Two details are worth holding on to. The low-severity bug was first reported in July, before the policy changed, and was swept into these releases with the new ones.
And one of the memory bugs was found independently by a second developer, L0rinc, within a week of the scan. That is the policy’s whole argument in one timeline: if two people find it, assume a third already has.
The cost falls on node operators, who now have to upgrade more often. The Windows and macOS bug is a good reason to do it this time.
Other open-source projects are learning the same lesson, as with the XRP Ledger’s patched overflow bug.
The bottom line: the first bugs through Bitcoin Core’s fast lane were found by a machine, fixed within days and published in the open, and if you run a node on Windows or a Mac, upgrade now.
— Alasdair
This article is for information only and is not investment advice.