Listen to this Post
The CVE-2024-31471 vulnerability in RISC Zero zkVM arises from improper handling of signed integer division operations. The circuit logic allowed two possible outputs for certain inputs, but only one was valid, leading to potential incorrect computations. Additionally, division-by-zero scenarios were insufficiently constrained, permitting undefined behavior. These flaws could be exploited to produce invalid zero-knowledge proofs, compromising the integrity of zkVM-based applications. The issue was detected using Veridise’s Picus tool, which identified the underconstrained arithmetic operations.
DailyCVE Form:
Platform: RISC Zero zkVM
Version: < 2.2.0
Vulnerability: Integer Division
Severity: Critical
Date: 2024-03-15
Prediction: Patch expected by 2024-03-22
What Undercode Say:
risc0-zkvm --version 2.2.0 picus analyze --target zkvm-circuit
How Exploit:
- Craft malicious division inputs
- Trigger undefined division-by-zero
- Bypass proof validation
Protection from this CVE:
- Upgrade to v2.2.0
- Use Verifier Router
- Audit arithmetic circuits
Impact:
- Invalid proofs
- Trust compromise
- Financial losses
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
