by NishantBansal2003

The issue discussed below was originally disclosed at nishantbansal2003.github.io. For the corresponding LND advisory, see: LND Gossip Nil-Map Panic on Zero-Timestamp Messages | Lightning Labs Security Advisories.

LND versions before v0.20.1 are vulnerable to a DoS issue where a specially crafted channel_update or node_announcement message can crash a node. Operators should upgrade promptly to avoid service disruption. The issue is fixed in v0.20.1 and later.

VulnerabilityVulnerability

The Lightning Network uses gossip messages to maintain a distributed view of the network graph. Nodes exchange channel_announcement, node_announcement, and channel_update messages to advertise channels and routing policies. Before accepting node_announcement and channel_update messages, a Lightning node must first know and validate the corresponding channel_announcement.

After validation, node_announcement and channel_update messages are propagated throughout the network. In LND, this propagation is handled by a gossip rebroadcast pipeline that uses a de-duplication cache to avoid repeatedly forwarding identical announcements. When a new announcement arrives, its timestamp is compared against any previously stored announcements for the same channel, direction and node. Newer announcements replace older ones, while older announcements are discarded. The implementation of this logic prior to v0.20.1 can be found in deDupedAnnouncements->addMsg.

The bug stems from how announcements with a timestamp of 0 are handled. When a zero-timestamp node_announcement or channel_update is received for the first time, no cache entry exists and oldTimestamp remains initialized to 0. As a result, the code incorrectly treats the announcement as a previously seen message and enters the duplicate-message path.

However, because no previous entry existed, the senders map was never initialized. Attempting to write to this nil map triggers a runtime panic that terminates the LND daemon, resulting in a complete loss of node availability until it is restarted.

...read more at delvingbitcoin.org