RISC Zero Platform Arbitrary Code Execution Vulnerability via Memory Safety Issue in sys_read

A critical arbitrary code execution vulnerability has been identified in the RISC Zero general computing platform, specifically within the risc0-zkvm-platform package, versions 2.0.2 and below. The issue arises when the zkVM guest invokes the sys_read function. In this scenario, the host can craft a response that writes to an arbitrary memory location in the guest. This exploitation allows for the execution of arbitrary code within the guest environment. Since sys_read is used to request input from the guest, all programs developed with the affected version are vulnerable. This vulnerability undermines the soundness guarantees of the guest program. Additional affected packages include risc0-aggregation versions prior to 0.9, risc0-zkos-v1compat versions prior to 2.1.0, and risc0-zkvm versions between 3.0.0-rc.1 and 3.0.1.

Impact

Exploitation of this vulnerability allows for arbitrary code execution within the guest environment of the RISC Zero platform.

Reproduction

The vulnerability can be reproduced by creating a zkVM guest program that uses the sys_read function to read input. When the program is executed, the host can craft a response that exploits the memory safety issue, allowing for arbitrary code execution in the guest.

Remediation

Developers should update their zkVM applications to use risc0-zkvm versions 2.3.2 or 3.0.3. This can be done by modifying the Cargo.toml file to reference the new versions. Applications that use the image ID of the guest will need to be updated with the new image ID. For those using the risc0-aggregation crate or the RiscZeroSetVerifier smart contract, version 0.9 or later should be used.