CVE-2024-50354: Github.com/consensys/gnark Gnark Out-of-memory During Deserialization With Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-cph5-3pgr-c82g",
  "modified" : "2024-11-04T13:48:55Z",
  "published" : "2024-10-31T20:37:00Z",
  "aliases" : [ "CVE-2024-50354" ],
  "summary" : "Gnark out-of-memory during deserialization with crafted inputs",
  "details" : "Thanks @pventuzelo for reporting.\n\nFrom the correspondence:\n\n> Hi,\n> \n> We (Fuzzinglabs & Lambdaclass) found that during deserialization of certain files representing a `VerifyingKey`, an excessive memory allocation is happening consuming a lot of resources and even triggering a crash with the error `fatal error: runtime: out of memory`.\n> \n> Please find the details below:\n> \n> ## Vulnerability Details\n> \n> - **Severity:** Critical -> DoS\n> - **Affected Component:** Deserialization\n> \n> ## Environment\n> \n> - **Compiler Version:** go version go1.22.2 linux/amd64\n> - **Distro Version:** Ubuntu 24.04.1 LTS\n> \n> - **Additional Environment Details:**\n>   - `[github.com/consensys/gnark](http://github.com/consensys/gnark) v0.11.0`\n>   - `[github.com/consensys/gnark-crypto](http://github.com/consensys/gnark-crypto) v0.14.1-0.20240909142611-e6b99e74cec1`\n> \n> ## Steps to Reproduce\n> \n> You can download the needed files here: https://drive.google.com/drive/folders/1KQ5I3vv4bUllvqbatGappwbAkIcR2NI_?usp=sharing\n> \n> You have to run\n> \n> ```shell\n> go run gnark_poc.go\n> ```\n> \n> in a terminal.\n> \n> Running the provided code will result in a memory crash or an extremely large memory allocation, which can be observed using the following command:\n> \n> ```shell\n> go tool pprof -web mem.pprof\n> ```\n> \n> ## Root Cause Analysis\n> \n> The provided code loads a `VerifyingKey` from `old.vk` by calling the `ReadFrom` function. This function is implemented in [backend/groth16/bn254/marshal.go](https://github.com/Consensys/gnark/blob/ca8e1568f47ae6b717eda0a6734d87645edaecf7/backend/groth16/bn254/marshal.go#L174C2-L174C25) within the [gnark](https://github.com/Consensys/gnark) library.\n> \n> The provided example uses the elliptic curve BN-254, so the code resides in the [backend/groth16/bn254/](https://github.com/Consensys/gnark/blob/ca8e1568f47ae6b717eda0a6734d87645edaecf7/backend/groth16/bn254/) repertory. However, the same error exists in other repertories, such as [backend/groth16/bls12-377/](https://github.com/Consensys/gnark/blob/ca8e1568f47ae6b717eda0a6734d87645edaecf7/backend/groth16/bls12-377/).\n> \n> At [line 207](https://github.com/Consensys/gnark/blob/ca8e1568f47ae6b717eda0a6734d87645edaecf7/backend/groth16/bn254/marshal.go#L207), a slice is allocated with a length of `nbCommitments`. This variable is directly extracted from the deserialized file, which, in our case, has a value of `2,327,186,600`. This large value may be too big for some configurations, leading to memory allocations of approximately ±1 TB, as observed with `pprof`.\n> \n> ## Detailed Behavior\n> \n> ```shell\n> go run gnark_poc.go\n> ```\n> \n> ```\n> fatal error: runtime: out of memory\n> \n> runtime stack:\n> runtime.throw({0x5fe946?, 0x2052ae?})\n> /usr/lib/go-1.22/src/runtime/panic.go:1023 +0x5c fp=0x7ffd65b321a0 sp=0x7ffd65b32170 pc=0x438a9c\n> runtime.sysMapOS(0xc000400000, 0x8ab6400000)\n> /usr/lib/go-1.22/src/runtime/mem_linux.go:167 +0x11b fp=0x7ffd65b321e0 sp=0x7ffd65b321a0 pc=0x418bbb\n> runtime.sysMap(0xc000400000, 0x8ab6400000, 0x7b19c8?)\n> /usr/lib/go-1.22/src/runtime/mem.go:155 +0x34 fp=0x7ffd65b32200 sp=0x7ffd65b321e0 pc=0x418634\n> runtime.(*mheap).grow(0x7a17c0, 0x455b066?)\n> /usr/lib/go-1.22/src/runtime/mheap.go:1534 +0x236 fp=0x7ffd65b32270 sp=0x7ffd65b32200 pc=0x42b176\n> runtime.(*mheap).allocSpan(0x7a17c0, 0x455b066, 0x0, 0x1)\n> /usr/lib/go-1.22/src/runtime/mheap.go:1246 +0x1b0 fp=0x7ffd65b32310 sp=0x7ffd65b32270 pc=0x42a850\n> runtime.(*mheap).alloc.func1()\n> /usr/lib/go-1.22/src/runtime/mheap.go:964 +0x5c fp=0x7ffd65b32358 sp=0x7ffd65b32310 pc=0x42a2fc\n> runtime.systemstack(0x46d79f)\n> /usr/lib/go-1.22/src/runtime/asm_amd64.s:509 +0x4a fp=0x7ffd65b32368 sp=0x7ffd65b32358 pc=0x46912a\n> \n> goroutine 1 gp=0xc0000061c0 m=0 mp=0x798ca0 [running]:\n> runtime.systemstack_switch()\n> /usr/lib/go-1.22/src/runtime/asm_amd64.s:474 +0x8 fp=0xc000031b68 sp=0xc000031b58 pc=0x4690c8\n> runtime.(*mheap).alloc(0x5bc040?, 0xc00012bb08?, 0xa0?)\n> /usr/lib/go-1.22/src/runtime/mheap.go:958 +0x5b fp=0xc000031bb0 sp=0xc000031b68 pc=0x42a25b\n> runtime.(*mcache).allocLarge(0xc000126510?, 0x8ab60ca800, 0x1)\n> /usr/lib/go-1.22/src/runtime/mcache.go:234 +0x87 fp=0xc000031c00 sp=0xc000031bb0 pc=0x4176e7\n> runtime.mallocgc(0x8ab60ca800, 0x5d92a0, 0x1)\n> /usr/lib/go-1.22/src/runtime/malloc.go:1165 +0x597 fp=0xc000031c88 sp=0xc000031c00 pc=0x40ef97\n> runtime.makeslice(0xc00011c180?, 0x0?, 0x2?)\n> /usr/lib/go-1.22/src/runtime/slice.go:107 +0x49 fp=0xc000031cb0 sp=0xc000031c88 pc=0x4500c9\n> [github.com/consensys/gnark/backend/groth16/bn254.(*VerifyingKey).readFrom(0xc0001b7088](http://github.com/consensys/gnark/backend/groth16/bn254.(*VerifyingKey).readFrom(0xc0001b7088), {0x6598a0, 0xc00011dc50}, 0x0)\n> /home/raunan/go/pkg/mod/[github.com/!ronan!thoraval/gnark@v0.0.0-20241007163125-4c0a7511c3d1/backend/groth16/bn254/marshal.go:214](http://github.com/!ronan!thoraval/gnark@v0.0.0-20241007163125-4c0a7511c3d1/backend/groth16/bn254/marshal.go:214) +0x765 fp=0xc000031ea8 sp=0xc000031cb0 pc=0x59b205\n> [github.com/consensys/gnark/backend/groth16/bn254.(*VerifyingKey).ReadFrom(0x100469020](http://github.com/consensys/gnark/backend/groth16/bn254.(*VerifyingKey).ReadFrom(0x100469020)?, {0x6598a0?, 0xc00011dc50?})\n> /home/raunan/go/pkg/mod/[github.com/!ronan!thoraval/gnark@v0.0.0-20241007163125-4c0a7511c3d1/backend/groth16/bn254/marshal.go:166](http://github.com/!ronan!thoraval/gnark@v0.0.0-20241007163125-4c0a7511c3d1/backend/groth16/bn254/marshal.go:166) +0x1f fp=0xc000031ed8 sp=0xc000031ea8 pc=0x59aa5f\n> main.main()\n> /home/raunan/gnark_poc/gnark_poc/gnark_poc.go:19 +0xba fp=0xc000031f50 sp=0xc000031ed8 pc=0x5addda\n> runtime.main()\n> /usr/lib/go-1.22/src/runtime/proc.go:271 +0x29d fp=0xc000031fe0 sp=0xc000031f50 pc=0x43b55d\n> runtime.goexit({})\n> /usr/lib/go-1.22/src/runtime/asm_amd64.s:1695 +0x1 fp=0xc000031fe8 sp=0xc000031fe0 pc=0x46b0e1\n> \n> goroutine 2 gp=0xc000006c40 m=nil [force gc (idle)]:\n> runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)\n> /usr/lib/go-1.22/src/runtime/proc.go:402 +0xce fp=0xc000074fa8 sp=0xc000074f88 pc=0x43b98e\n> runtime.goparkunlock(...)\n> /usr/lib/go-1.22/src/runtime/proc.go:408\n> runtime.forcegchelper()\n> /usr/lib/go-1.22/src/runtime/proc.go:326 +0xb3 fp=0xc000074fe0 sp=0xc000074fa8 pc=0x43b813\n> runtime.goexit({})\n> /usr/lib/go-1.22/src/runtime/asm_amd64.s:1695 +0x1 fp=0xc000074fe8 sp=0xc000074fe0 pc=0x46b0e1\n> created by runtime.init.6 in goroutine 1\n> /usr/lib/go-1.22/src/runtime/proc.go:314 +0x1a\n> \n> goroutine 3 gp=0xc000007180 m=nil [GC sweep wait]:\n> runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)\n> /usr/lib/go-1.22/src/runtime/proc.go:402 +0xce fp=0xc000075780 sp=0xc000075760 pc=0x43b98e\n> runtime.goparkunlock(...)\n> /usr/lib/go-1.22/src/runtime/proc.go:408\n> runtime.bgsweep(0xc0000240e0)\n> /usr/lib/go-1.22/src/runtime/mgcsweep.go:278 +0x94 fp=0xc0000757c8 sp=0xc000075780 pc=0x426cf4\n> runtime.gcenable.gowrap1()\n> /usr/lib/go-1.22/src/runtime/mgc.go:203 +0x25 fp=0xc0000757e0 sp=0xc0000757c8 pc=0x41b845\n> runtime.goexit({})\n> /usr/lib/go-1.22/src/runtime/asm_amd64.s:1695 +0x1 fp=0xc0000757e8 sp=0xc0000757e0 pc=0x46b0e1\n> created by runtime.gcenable in goroutine 1\n> /usr/lib/go-1.22/src/runtime/mgc.go:203 +0x66\n> \n> goroutine 4 gp=0xc000007340 m=nil [GC scavenge wait]:\n> runtime.gopark(0xc0000240e0?, 0x657100?, 0x1?, 0x0?, 0xc000007340?)\n> /usr/lib/go-1.22/src/runtime/proc.go:402 +0xce fp=0xc000075f78 sp=0xc000075f58 pc=0x43b98e\n> runtime.goparkunlock(...)\n> /usr/lib/go-1.22/src/runtime/proc.go:408\n> runtime.(*scavengerState).park(0x797520)\n> /usr/lib/go-1.22/src/runtime/mgcscavenge.go:425 +0x49 fp=0xc000075fa8 sp=0xc000075f78 pc=0x4246e9\n> runtime.bgscavenge(0xc0000240e0)\n> /usr/lib/go-1.22/src/runtime/mgcscavenge.go:653 +0x3c fp=0xc000075fc8 sp=0xc000075fa8 pc=0x424c7c\n> runtime.gcenable.gowrap2()\n> /usr/lib/go-1.22/src/runtime/mgc.go:204 +0x25 fp=0xc000075fe0 sp=0xc000075fc8 pc=0x41b7e5\n> runtime.goexit({})\n> /usr/lib/go-1.22/src/runtime/asm_amd64.s:1695 +0x1 fp=0xc000075fe8 sp=0xc000075fe0 pc=0x46b0e1\n> created by runtime.gcenable in goroutine 1\n> /usr/lib/go-1.22/src/runtime/mgc.go:204 +0xa5\n> \n> goroutine 18 gp=0xc000102700 m=nil [finalizer wait]:\n> runtime.gopark(0xc000074648?, 0x40f445?, 0xa8?, 0x1?, 0xc0000061c0?)\n> /usr/lib/go-1.22/src/runtime/proc.go:402 +0xce fp=0xc000074620 sp=0xc000074600 pc=0x43b98e\n> runtime.runfinq()\n> /usr/lib/go-1.22/src/runtime/mfinal.go:194 +0x107 fp=0xc0000747e0 sp=0xc000074620 pc=0x41a887\n> runtime.goexit({})\n> /usr/lib/go-1.22/src/runtime/asm_amd64.s:1695 +0x1 fp=0xc0000747e8 sp=0xc0000747e0 pc=0x46b0e1\n> created by runtime.createfing in goroutine 1\n> /usr/lib/go-1.22/src/runtime/mfinal.go:164 +0x3d\n> exit status 2\n> ```\n> \n> ## Appendices\n> \n> This problem can also happen with `ProvingKey`.\n\n### Impact\n\nProver and verifier denial of service in case of maliciously crafted inputs (public key, verification key).\n\n### Patches\n\nThe issue is patched in https://github.com/Consensys/gnark/pull/1307. It was merged to gnark master at https://github.com/Consensys/gnark/commit/47ae846339add2bdf9983e499342bfdfe195191d. The fix will be incorporated in the next minor release of gnark (v0.11.1).\n\n### Workarounds\n\nThere are no convenient work-arounds currently. The best approach currently is to run key verification as a separate service which halts the verification pipeline in case of OOM when verification keys come from untrusted sources.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/consensys/gnark"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.11.1"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 0.11.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/Consensys/gnark/security/advisories/GHSA-cph5-3pgr-c82g"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-50354"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Consensys/gnark/pull/1307"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Consensys/gnark/commit/47ae846339add2bdf9983e499342bfdfe195191d"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/Consensys/gnark"
  }, {
    "type" : "ADVISORY",
    "url" : "https://github.com/advisories/GHSA-cph5-3pgr-c82g"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-400" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-10-31T20:37:00Z",
    "nvd_published_at" : "2024-10-31T16:15:05Z"
  }
}