CVE-2025-59942: Filecoin Go-f3 DOS Vulnerability

CVE-2025-59942 Overview

CVE-2025-59942 affects go-f3, the Golang implementation of Fast Finality for Filecoin (F3). Versions 0.8.6 and earlier panic when validating specially crafted "poison" messages. The flaw triggers an integer overflow in the signer index validation routine, crashing any Filecoin node that consumes F3 messages. The bug resides in the validator, so malicious messages do not self-propagate across the gossip network. An attacker must directly deliver the poison message to each target node. The maintainers fixed the issue in version 0.8.7.

Critical Impact

Remote, unauthenticated attackers can crash Filecoin nodes by sending a single malformed F3 message, disrupting consensus participation and network availability.

Affected Products

• Filecoin go-f3 versions <= 0.8.6
• Filecoin nodes consuming F3 messages via vulnerable go-f3 releases
• Downstream Filecoin client implementations embedding go-f3

Discovery Timeline

• 2025-09-29 - CVE-2025-59942 published to NVD
• 2025-10-18 - Last updated in NVD database

Technical Details for CVE-2025-59942

Vulnerability Analysis

The vulnerability is an integer overflow [CWE-190] in the F3 message validator. F3 messages include a signer index that the validator processes during verification. When the index value exceeds the bounds the validator assumes, arithmetic on that value wraps around, producing an invalid state that triggers a Go runtime panic. Because Filecoin nodes consume F3 messages as part of normal consensus participation, the panic terminates the node process and removes it from the network.

The attack does not require authentication or privileges. Any network-reachable peer can submit a crafted message. Confidentiality and integrity remain intact, but availability is fully compromised for the affected node.

Root Cause

The signer index validation logic in go-f3 performs arithmetic on attacker-controlled integer fields without sufficient bounds checking. A maliciously chosen index causes integer overflow during validation. The resulting condition is unrecoverable and converts into a Go panic that propagates up the call stack, terminating the node.

Attack Vector

Exploitation occurs over the network. The attacker constructs a poison F3 message containing an out-of-range signer index and sends it directly to a target Filecoin node. Standard F3 gossip propagation does not relay the message because the bug aborts the validator before re-broadcast logic executes. Attackers therefore need to enumerate and reach each target node individually, but a single message per node is sufficient to induce a crash.

The vulnerability is described in prose because no public proof-of-concept code is available. See the GitHub Security Advisory GHSA-g99p-47x7-mq88 for vendor-supplied technical details.

Detection Methods for CVE-2025-59942

Indicators of Compromise

• Unexpected Go runtime panic stack traces referencing F3 message validation in node logs
• Repeated abnormal terminations of the Filecoin node process shortly after receiving inbound peer traffic
• Inbound F3 messages from previously unseen or low-reputation peers preceding crashes

Detection Strategies

• Monitor node process lifecycle and alert on crashes correlated with F3 message ingestion
• Inspect logs for panic signatures originating in go-f3 validator code paths
• Track the deployed go-f3 version across infrastructure and flag any host running <= 0.8.6

Monitoring Recommendations

• Aggregate Filecoin node telemetry into a centralized SIEM for crash and uptime correlation
• Alert on sudden drops in F3 participation or finality contribution from monitored nodes
• Capture peer connection metadata around crash events to identify the source of poison messages

How to Mitigate CVE-2025-59942

Immediate Actions Required

• Upgrade go-f3 to version 0.8.7 or later on every Filecoin node in the environment
• Rebuild and redeploy any downstream Filecoin client that vendors go-f3 as a dependency
• Restart affected nodes after patching to ensure the vulnerable validator is unloaded

Patch Information

The maintainers fixed the issue in go-f3 version 0.8.7. Operators should pull the patched release from the filecoin-project/go-f3 repository and reference the GitHub Security Advisory for verification details.

Workarounds

• Restrict inbound peer connectivity to trusted peers where operationally feasible until patching completes
• Deploy node-level process supervision to automatically restart crashed Filecoin processes and reduce downtime
• Rate-limit or filter F3 message ingestion at the network boundary to slow targeted poison-message delivery

# Update go-f3 dependency to the patched version
go get github.com/filecoin-project/go-f3@v0.8.7
go mod tidy
go build ./...