Details have been disclosed about three security vulnerabilities found in Bitcoin Core through AI-assisted scanning, and the risk reportedly remains after patching on some older systems.
According to CoinDesk, the disclosed issues affect Bitcoin Core, the software used by nodes that verify Bitcoin transactions and relay them across the network. The vulnerabilities can consume nodes’ memory, causing them to crash or become unusable.
All three findings were detected by a large language model scanning code and reviewed by human contributors before being sent to the security team. The first vulnerability, which affects Windows, macOS, and BSD systems, was found on October 23, verified the same day, and patched on October 27. Details were disclosed on Wednesday, October 28, along with the other two vulnerabilities.
Data sent over a connection can consume memory
In the first vulnerability, a computer connected to the target node could consume its available memory by sending large amounts of data. As a result, a node running on Windows, macOS, or BSD could crash.
In the second issue, a peer node could claim to be using an older protocol version and pause communication, causing messages to accumulate on the target. The security advisory said memory usage could increase by up to 2 MB per hour for each incoming connection and up to 5 MB per hour for each outgoing connection.
This second vulnerability was reported to the project on September 15 and independently rediscovered by another developer six days later. The same issue being discovered twice in quick succession was one reason developers changed their approach to keeping vulnerabilities confidential.
Risk remains on 32-bit systems and FAT32 drives
The third vulnerability, rated low severity, concerns undo files used when replacing the last blocks in the chain with alternative blocks. Special blocks created by a miner could cause these files to overflow.
While exploiting the issue on 64-bit machines would require an amount equivalent to about a month’s worth of total network block production, nodes on Windows and 32-bit systems could become completely unusable. According to the disclosure, restarting would not resolve the issue in such a case.
Nodes running on 32-bit machines or storing blocks on FAT32-formatted drives remain exposed to this risk even after the patch. The software patch’s effectiveness therefore varies depending on the system and storage format in use.
AI changes the timeline for disclosing vulnerabilities
Bitcoin Core developers had previously been able to keep medium-severity vulnerabilities confidential for up to a year so operators could update their software. On October 22, the project changed this policy for vulnerabilities considered easy to discover.
Because large language models can find these issues at low cost, fixes will now be sent to supported versions as soon as possible and shared through security advisories.
The release notes also said details of three other medium- and high-severity vulnerabilities fixed in version 30.0 would be disclosed within two weeks.
Not investment advice.