Listen to this Post
The CVE-2024-43390 vulnerability is a critical memory exhaustion flaw within the `gnark-crypto` library, specifically in the `Vector.ReadFrom()` method used for deserializing data. The function operates by reading a 4-byte unsigned integer from the input stream, which it interprets as the number of elements for a new slice. This value is used directly in a `make()` function call to allocate memory without any bounds checking. Since the length field is controlled by an untrusted user, an attacker can provide a maliciously large value, such as the maximum 32-bit integer (2^32 – 1). For the BN254 curve, where each element consumes 32 bytes, this results in an attempted allocation of over 128 GB of memory. This massive, uncontrolled allocation triggers an out-of-memory (OOM) condition in the Go runtime, causing the application to abort with a `SIGABRT` and leading to a denial-of-service.
Platform: gnark-crypto
Version: < 0.18.0
Vulnerability: Memory Exhaustion
Severity: Critical
date: 2024
Prediction: 2024-10-31
What Undercode Say:
`./proof –verify malicious_proof.bin`
`go run fuzz_vector.go`
`sliceLen := binary.BigEndian.Uint32(buf[:4])`
`(vector) = make(Vector, sliceLen)`
`fatal error: runtime: out of memory`
How Exploit:
Craft malicious input with a large length field (e.g., 0xFFFFFFFF) in the first 4 bytes. Send this payload to any service that deserializes untrusted data using the vulnerable `Vector.ReadFrom()` function. This will cause the service to attempt an impossible memory allocation, crashing the process.
Protection from this CVE:
Update gnark-crypto to v0.18.0+.
Validate slice length before allocation.
Implement input size limits.
Use fuzzing for detection.
Impact:
Denial-of-Service (DoS).
Application crash (SIGABRT).
High memory consumption.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
