GHSA-8m24-3cfx-9fjw: Sp1 recursion circuit Sp1 Has Insufficient Observation Of Vulnerability

LOW
Share
Published
Advisory Summary

GHSA-8m24-3cfx-9fjw is a LOW sp1 has insufficient observation of vulnerability (General Security Weakness) affecting Sp1 recursion circuit libraries in the crates.io ecosystem. The issue involves sp1 has insufficient observation of cumulative sum. Remediation is available by upgrading affected packages to version 3.0.0.

GHSA-8m24-3cfx-9fjw at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-8m24-3cfx-9fjw
Severity LOW
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Sp1 recursion circuit
Package Ecosystem crates.io
Published Date
Last Updated

How to Fix GHSA-8m24-3cfx-9fjw

To remediate this vulnerability, upgrade all affected Sp1 recursion circuit dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

sp1-recursion-circuit fixed: 3.0.0 
Upgrade sp1-recursion-circuit to 3.0.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for sp1-recursion-circuit

How to Check if You Are Affected

To determine whether your application is affected by GHSA-8m24-3cfx-9fjw, inspect your project dependencies for Sp1 recursion circuit:

inspect dependencies for sp1-recursion-circuit

Analyze the terminal output to locate any version of Sp1 recursion circuit in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 3.0.0), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Sp1 recursion circuit, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

During proof generation, the prover must observe all values sent to the verifier to generate valid Fiat-Shamir challenges. Prior to v3.0.0 the cumulative sum of the permutation argument was not observed when sampling zeta, which is a random challenge sampled to force the constraints to be true. In v3.0.0, this is fixed by observing the cumulative sum into the challenger, which can is done by observing the commit to the entire permutation trace. While this vulnerability is theoretically present in v2.0.0 and below, exploiting it is quite a difficult task as the cumulative sum one can get from manipulation is essentially random. It requires practically infeasible amount of computation and deep knowledge of cryptographic attacks to carry out. This issue was discovered during the audit of SP1 V3.0.0 and was officially fixed on October 17th. Out of abundance of caution, we will be deprecating all versions of SP1 before 3.0.0.

GHSA-8m24-3cfx-9fjw Affected Sp1 recursion circuit Versions

1 component(s)
Fixed Versions:
3.0.0
Product / Package Ecosystem Affected Versions Fixed Version
sp1-recursion-circuit
 crates.io
< 3.0.0
3.0.0

References

GitHub Advisory / Wiki ADVISORY
https://github.com/succinctlabs/sp1/security/advisories/GHSA-8m24-3cfx-9fjw
Security Fix Commit FIX COMMIT
https://github.com/succinctlabs/sp1/commit/79884ffb1a2d10bfd2c272f864033577a052468a
Sp1 recursion circuit Source Repository REPOSITORY
https://github.com/succinctlabs/sp1

Frequently Asked Questions

What is GHSA-8m24-3cfx-9fjw?
GHSA-8m24-3cfx-9fjw is a security vulnerability in Sp1 recursion circuit involving sp1 has insufficient observation of cumulative sum under General Security Weakness.
Which Sp1 recursion circuit versions are affected?
Affected versions include releases prior to 3.0.0 across affected packages: sp1-recursion-circuit.
What version fixes GHSA-8m24-3cfx-9fjw?
Upgrading to 3.0.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is sp1-recursion-circuit affected?
Yes, sp1-recursion-circuit is affected in releases prior to 3.0.0. Upgrade your dependency to 3.0.0 or later.
What CWE is associated with GHSA-8m24-3cfx-9fjw?
GHSA-8m24-3cfx-9fjw is classified under General Security Weakness.
How can I check crates.io dependencies for GHSA-8m24-3cfx-9fjw?
Run the dependency tree command: 'inspect dependencies for sp1-recursion-circuit'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-8m24-3cfx-9fjw",
  "modified" : "2024-11-08T16:44:15Z",
  "published" : "2024-11-08T16:44:15Z",
  "aliases" : [ ],
  "summary" : "sp1 has insufficient observation of cumulative sum",
  "details" : "During proof generation, the prover must observe all values sent to the verifier to generate valid Fiat-Shamir challenges. Prior to v3.0.0 the cumulative sum of the permutation argument was not observed when sampling zeta, which is a random challenge sampled to force the constraints to be true. In v3.0.0, this is fixed by observing the cumulative sum into the challenger, which can is done by observing the commit to the entire permutation trace.\n\nWhile this vulnerability is theoretically present in v2.0.0 and below, exploiting it is quite a difficult task as the cumulative sum one can get from manipulation is essentially random. It requires practically infeasible amount of computation and deep knowledge of cryptographic attacks to carry out.\n\nThis issue was discovered during the audit of SP1 V3.0.0 and was officially fixed on October 17th. Out of abundance of caution, we will be deprecating all versions of SP1 before 3.0.0.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "crates.io",
      "name" : "sp1-recursion-circuit"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "3.0.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/succinctlabs/sp1/security/advisories/GHSA-8m24-3cfx-9fjw"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/succinctlabs/sp1/commit/79884ffb1a2d10bfd2c272f864033577a052468a"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/succinctlabs/sp1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-11-08T16:44:15Z",
    "nvd_published_at" : null
  }
}