PT-2022-28261 · Ckb · Ckb

Published 2022-11-02 · Updated 2022-11-02

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions ckb version 0.101.2

Description The issue arises when the max cycles is insufficient, causing ScriptError::ExceededMaximumCycles to be raised directly instead of suspending as expected. This occurs randomly due to the random execution order of script group.

Recommendations For version 0.101.2, consider modifying the TypeIdSystemScript resume handle to correctly suspend execution when max cycles is not enough, rather than directly raising ScriptError::ExceededMaximumCycles. As a temporary workaround, consider implementing a check to ensure max cycles is sufficient before executing the script to minimize the risk of random errors.

Related Identifiers

GHSA-MCMR-49X3-4JQM

Affected Products

Ckb

References · 4

• https://osv.dev/vulnerability/GHSA-mcmr-49x3-4jqm · Vendor Advisory
• https://github.com/nervosnetwork/ckb · Note
• https://github.com/nervosnetwork/ckb/security/advisories/GHSA-mcmr-49x3-4jqm · Note
• https://github.com/nervosnetwork/ckb/blob/v0.101.2/script/src/verify.rs#L871-L879 · Note