The go-f3 implementation for Filecoin is vulnerable to a denial of service attack that can crash nodes via crafted poison messages.

This vulnerability is caused by an integer overflow during the validation of signer indices within poison messages (CWE-190). An unauthenticated remote attacker can force a node to panic by sending these crafted messages directly to the target.

The exploitation of this flaw results in a complete denial of service for affected Filecoin nodes, potentially disrupting critical blockchain finality processes. With a CVSS score of 7.5, this represents a high-severity risk to network availability and operational stability, as attackers can force node crashes without requiring any prior authentication.

Immediate Action: Update the go-f3 package to version 0.8.7 or later to incorporate the necessary integer overflow protections.

Proactive Monitoring: Monitor system logs for repeated node panic events or unexpected process terminations that may indicate targeted exploitation attempts.

Compensating Controls: While a direct patch is required, ensure that node network access is restricted to trusted peers to prevent unauthorized parties from delivering malicious payloads directly to the validator.

Public Exploit Available: Unknown.

Given the potential for service disruption, administrators managing Filecoin nodes utilizing the go-f3 library must prioritize this update. Applying version 0.8.7 is the only reliable way to resolve the integer overflow condition and prevent node crashes, ensuring continued network reliability and integrity.