Listen to this Post
The vulnerability exists in the `sys_read` system call handler within the RISC Zero zkVM guest platform. In affected versions, the implementation used unsafe pointer arithmetic to manage data written from the host to the guest’s memory. A malicious host could craft a response to a guest’s `sys_read` call that specifies an arbitrary target memory address within the guest. This bypasses the intended memory safety guarantees, allowing the host to perform arbitrary writes into the guest’s memory space. By carefully overwriting function pointers or other critical data structures, an attacker can manipulate the guest’s control flow to execute arbitrary code. This fundamentally breaks the isolation and soundness guarantees of the zkVM, as the guest’s execution integrity can be fully compromised by a dishonest host.
Platform: RISC Zero zkVM
Version: <2.3.2, <3.0.3
Vulnerability: Memory Corruption
Severity: Critical
date: 2024
Prediction: Q1 2024
What Undercode Say:
cargo tree --depth 0 -p risc0-zkvm-platform --manifest-path guest/Cargo.toml
risc0-zkvm = "2.3.2" risc0-build = "2.3.2" risc0-zkvm-platform = "2.1.0"
How Exploit:
Malicious host crafts `sys_read` response.
Response overwrites guest memory.
Control flow is hijacked.
Arbitrary code executes.
Protection from this CVE
Update `risc0-zkvm` to ^2.3.2 or ^3.0.3.
Update `risc0-zkvm-platform` to ^2.1.0.
Rebuild guest programs.
Verify dependencies with `cargo tree`.
Impact:
Total guest compromise.
Broken soundness guarantees.
Arbitrary code execution.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
