GO-2023-2119

    Dashboard / Vulnerabilities / GO-2023-2119

    GO-2023-2119

    Published: 24 Oct 2023Last Modified: 20 May 2024

    Summary: Proof forgery due to insufficient randomness in github.com/consensys/gnark

    Details: A a third party may derive a valid proof from a valid initial tuple {proof, public_inputs}, corresponding to the same public inputs as the initial proof. This vulnerability is due to randomness being generated using a small part of the scratch memory describing the state, allowing for degrees of freedom in the transcript. Note that the impact is limited to the PlonK verifier smart contract.

    References: https://github.com/Consensys/gnark/security/advisories/GHSA-7p92-x423-vwj6, https://github.com/Consensys/gnark/commit/3421eaa7d544286abf3de8c46282b8d4da6d5da0

    Affected packages

    Package

    Name: github.com/consensys/gnark

    Purl: pkg:golang/github.com/consensys/gnark

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -0.9.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GO-2023-2119 | CVE-DB