Miggo Logo
Miggo Vulnerability Database
→
GHSA-rjjm-x32p-m3f7

GHSA-rjjm-x32p-m3f7: gnark's range checker gadget allows wider inputs up to word alignment

3.2

CVSS Score
3.1

Basic Information

CVE ID
-
GHSA ID
GHSA-rjjm-x32p-m3f7
EPSS Score
-
CWE
-
Published
11/12/2023
Updated
11/12/2023
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/consensys/gnarkgo< 0.9.20.9.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from how rangecheck_commit.go's commit function handled limb decomposition. The original implementation only checked baseLength-bit partitions but didn't account for cases where the total partition bits (nbLimbs*baseLength) exceeded the required bit constraint. The patch added a critical conditional check (lines 96-108 in the diff) that constrains the shifted most significant limb when there's a discrepancy between partition alignment and requested bit length. This matches the vulnerability description of allowing inputs up to 16 bits wider than checked.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t *n*rk provi**s * *****t in t** st*n**r* li*r*ry to *llow optimiz** ****kin* o* t** *itwi*t* o* t** inputs. T** *****t works *y *onstru*tin* * *ix** lookup t**l* *ont*inin* *ll v*li* *ntri*s, p*rtitionin* t** input *n* ****kin* t**t *ll p*

Reasoning

T** vuln*r**ility st*mm** *rom *ow `r*n******k_*ommit.*o`'s *ommit *un*tion **n*l** lim* ***omposition. T** ori*in*l impl*m*nt*tion only ****k** `**s*L*n*t*`-*it p*rtitions *ut *i*n't ***ount *or **s*s w**r* t** tot*l p*rtition *its (`n*Lim*s***s*L*n