openvm v1.6.0 Security Advisory: Fixes SHA-256/Keccak Circuit and Recursive Verifier Vulnerabilities

Vulnerability Overview The webpage screenshot displays the release notes for version v1.6.0 of the project, which includes multiple security fixes. The primary vulnerabilities include: 1. SHA-256 and Keccak Circuit Issues: - Vulnerabilities exist in the SHA-256 and Keccak circuits (GHSA-99x-4b44-497). - The pairing library ( ) lacks appropriate subfield checks in its pairing verification (GHSA-76mq-v757-53g). - The native recursive verifier lacks constraints and circuits within the program (GHSA-dm2-2hc5-k82). - System AIRs lack boolean or zero assertions (GHSA-th2b-2999-qm9). 2. Other Security Issues: - The recursive verifier lacks boundary checks for uninitialized memory. - The recursive verifier lacks boundary checks for dynamic arrays. - The recursive verifier lacks boundary checks for malicious data sources. - The recursive verifier lacks injection protection for additional post-challenge exposed value vectors. - The recursive verifier lacks correct computation for the ASM instruction. - The recursive verifier lacks boundary checks for the internal hash of . - The recursive verifier lacks updates to . - The recursive verifier lacks constraints for . - The recursive verifier lacks arithmetic overflow protection for . - The recursive verifier lacks zero assertions for . - The recursive verifier lacks Fp6 subfield checks for . - The recursive verifier lacks point constructor checks for . - The recursive verifier lacks 256-bit type restrictions for . - The recursive verifier lacks Out-of-Bounds (OOB) read fixes for . Affected Scope Affected Versions: v1.5.0 and earlier. Affected Components: - SHA-256 and Keccak circuits. - library. - Native recursive verifier. - System AIRs. - Multiple boundary checks and constraints within the recursive verifier. - . - . - . - . - . - . - . Remediation Version Upgrade: It is recommended that all users upgrade to version v1.6.0. Specific Fixes: - Fixed SHA-256 and Keccak circuits. - Added appropriate subfield checks to the library. - Added missing constraints and circuits to the native recursive verifier. - Added missing boolean or zero assertions to system AIRs. - Added boundary checks and constraints to multiple parts of the recursive verifier. - Updated . - Added constraints to . - Added arithmetic overflow protection to . - Added zero assertions to . - Added Fp6 subfield checks to . - Added point constructor checks to . - Added 256-bit type restrictions to . - Fixed Out-of-Bounds (OOB) reads in . POC Code or Exploit Code No specific POC code or exploit code was provided in the page.

Goal Reached Thanks to every supporter — we hit 100%!

openvm v1.6.0 Security Advisory: Fixes SHA-256/Keccak Circuit and Recursive Verifier Vulnerabilities

More from this source