GHSA-pffg-92cg-xf5c: Github.com/consensys/gnark crypto Gnark-crypto's Exponentiation Vulnerability

LOW
Share
Published
Advisory Summary

GHSA-pffg-92cg-xf5c is a LOW gnark-crypto's exponentiation vulnerability (General Security Weakness) affecting Github.com/consensys/gnark crypto libraries in the Go ecosystem. The issue involves gnark-crypto's exponentiation in the pairing target group gt using glv can give incorrect results. Remediation is available by upgrading affected packages to version 0.12.1.

GHSA-pffg-92cg-xf5c at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-pffg-92cg-xf5c
Severity LOW
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Github.com/consensys/gnark crypto
Package Ecosystem Go
Published Date
Last Updated

How to Fix GHSA-pffg-92cg-xf5c

To remediate this vulnerability, upgrade all affected Github.com/consensys/gnark crypto dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

github.com/consensys/gnark-crypto fixed: 0.12.1 
Upgrade github.com/consensys/gnark-crypto to 0.12.1
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for github.com/consensys/gnark-crypto

How to Check if You Are Affected

To determine whether your application is affected by GHSA-pffg-92cg-xf5c, inspect your project dependencies for Github.com/consensys/gnark crypto:

inspect dependencies for github.com/consensys/gnark-crypto

Analyze the terminal output to locate any version of Github.com/consensys/gnark crypto in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.12.1), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Github.com/consensys/gnark crypto, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact When the exponent is bigger than `r`, the group order of the pairing target group `GT`, the exponentiation à la GLV (`ExpGLV`) can *sometimes* give incorrect results compared to normal exponentiation (`Exp`). The issue impacts all users using `ExpGLV` for exponentiations in `GT`. This does not impact `Exp` and `ExpCyclotomic` which are sound. Also note that GLV methods in G1 and G2 are sound and _not_ impacted. ### Patches Fix has been implemented in pull request https://github.com/Consensys/gnark-crypto/pull/451 and merged in commit https://github.com/Consensys/gnark-crypto/commit/ec6be1a037f7c496d595c541a8a8d31c47bcfa3d to master branch. The fix increased the bounds of the sub-scalars by 1. In fact, since https://github.com/Consensys/gnark-crypto/pull/213, we use a fast scalar decomposition that tradeoffs divisions (needed in the Babai rounding) by right-shifts. We precompute `b=2^m*v/d (m > log2(d))` and then at runtime compute `scalar*b/2^m` (`v` is a lattice vector and `d` the lattice determinant). This increases the bounds on sub-scalars by 1 which we check at runtime before increasing the loop size (we don't target constant-timeness). `m` is chosen to be a machine word twice big than `log2(d)` so that we rarely need to increase the loop size. Hence why the issue happens only *sometimes* if we omit to increase the bounds. This bounds increase was implemented in G1 and G2 but forgot in GT. ### Workarounds Updating to `v0.12.1+`. Alternatively, use `Exp` or `ExpCyclotomic` instead. We are not aware of any users using `ExpGLV` anyway. ### References - Fix PR: https://github.com/Consensys/gnark-crypto/pull/451 - Fast scalar decomposition PR: https://github.com/Consensys/gnark-crypto/pull/213 - https://eprint.iacr.org/2015/565 Sec.4.2 ### Acknowledgement The vulnerability was reported by [Antonio Sanso](https://github.com/asanso) @ [EF](https://crypto.ethereum.org/).

GHSA-pffg-92cg-xf5c Affected Github.com/consensys/gnark crypto Versions

1 component(s)
Fixed Versions:
0.12.1
Product / Package Ecosystem Affected Versions Fixed Version
github.com/consensys/gnark-crypto
golang/github.com/consensys/gnark-crypto
Go
< 0.12.1
0.12.1

References

GitHub Advisory / Wiki ADVISORY
https://github.com/Consensys/gnark-crypto/security/advisories/GHSA-pffg-92cg-xf5c
Github.com/consensys/gnark crypto Source Repository REPOSITORY
https://github.com/Consensys/gnark-crypto/pull/213
Github.com/consensys/gnark crypto Source Repository REPOSITORY
https://github.com/Consensys/gnark-crypto/pull/451
Security Fix Commit FIX COMMIT
https://github.com/Consensys/gnark-crypto/commit/ec6be1a037f7c496d595c541a8a8d31c47bcfa3d
eprint.iacr.org/2015/565 WEB
https://eprint.iacr.org/2015/565
Github.com/consensys/gnark crypto Source Repository REPOSITORY
https://github.com/Consensys/gnark-crypto

Frequently Asked Questions

What is GHSA-pffg-92cg-xf5c?
GHSA-pffg-92cg-xf5c is a security vulnerability in Github.com/consensys/gnark crypto involving gnark-crypto's exponentiation in the pairing target group GT using GLV can give incorrect results under General Security Weakness.
Which Github.com/consensys/gnark crypto versions are affected?
Affected versions include releases prior to 0.12.1 across affected packages: github.com/consensys/gnark-crypto.
What version fixes GHSA-pffg-92cg-xf5c?
Upgrading to 0.12.1 (or the latest patched release for your respective branch) resolves the vulnerability.
Is github.com/consensys/gnark-crypto affected?
Yes, github.com/consensys/gnark-crypto is affected in releases prior to 0.12.1. Upgrade your dependency to 0.12.1 or later.
What CWE is associated with GHSA-pffg-92cg-xf5c?
GHSA-pffg-92cg-xf5c is classified under General Security Weakness.
How can I check Go dependencies for GHSA-pffg-92cg-xf5c?
Run the dependency tree command: 'inspect dependencies for github.com/consensys/gnark-crypto'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-pffg-92cg-xf5c",
  "modified" : "2024-05-20T21:55:42Z",
  "published" : "2023-10-05T20:57:20Z",
  "aliases" : [ ],
  "summary" : "gnark-crypto's exponentiation in the pairing target group GT using GLV can give incorrect results",
  "details" : "### Impact\nWhen the exponent is bigger than `r`, the group order of the pairing target group `GT`, the exponentiation à la GLV (`ExpGLV`) can *sometimes* give incorrect results compared to normal exponentiation (`Exp`). \n\nThe issue impacts all users using `ExpGLV` for exponentiations in `GT`. This does not impact `Exp` and `ExpCyclotomic` which are sound. Also note that GLV methods in G1 and G2 are sound and _not_ impacted.\n\n### Patches\nFix has been implemented in pull request https://github.com/Consensys/gnark-crypto/pull/451 and merged in commit https://github.com/Consensys/gnark-crypto/commit/ec6be1a037f7c496d595c541a8a8d31c47bcfa3d to master branch.\n\nThe fix increased the bounds of the sub-scalars by 1. In fact, since https://github.com/Consensys/gnark-crypto/pull/213, we use a fast scalar decomposition that tradeoffs divisions (needed in the Babai rounding) by right-shifts. We precompute `b=2^m*v/d (m > log2(d))` and then at runtime compute `scalar*b/2^m` (`v` is a lattice vector and `d` the lattice determinant). This increases the bounds on sub-scalars by 1 which we check at runtime before increasing the loop size (we don't target constant-timeness). `m` is chosen to be a machine word twice big than `log2(d)` so that we rarely need to increase the loop size. Hence why the issue happens only *sometimes* if we omit to increase the bounds. This bounds increase was implemented in G1 and G2 but forgot in GT.\n\n### Workarounds\nUpdating to `v0.12.1+`. Alternatively, use `Exp` or `ExpCyclotomic` instead. We are not aware of any users using `ExpGLV` anyway.\n\n### References\n- Fix PR: https://github.com/Consensys/gnark-crypto/pull/451 \n- Fast scalar decomposition PR: https://github.com/Consensys/gnark-crypto/pull/213\n- https://eprint.iacr.org/2015/565 Sec.4.2\n\n### Acknowledgement\nThe vulnerability was reported by [Antonio Sanso](https://github.com/asanso) @ [EF](https://crypto.ethereum.org/).\n",
  "severity" : [ ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/consensys/gnark-crypto"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.12.1"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 0.12.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/Consensys/gnark-crypto/security/advisories/GHSA-pffg-92cg-xf5c"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Consensys/gnark-crypto/pull/213"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Consensys/gnark-crypto/pull/451"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Consensys/gnark-crypto/commit/ec6be1a037f7c496d595c541a8a8d31c47bcfa3d"
  }, {
    "type" : "WEB",
    "url" : "https://eprint.iacr.org/2015/565"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/Consensys/gnark-crypto"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2023-10-05T20:57:20Z",
    "nvd_published_at" : null
  }
}