GHSA-mcmr-49x3-4jqm: ckb type_id script resume may randomly fail

November 2, 2022

https://github.com/nervosnetwork/ckb/blob/v0.101.2/script/src/verify.rs#L871-L879 TypeIdSystemScript resume handle is not correct when max_cycles is not enough, ScriptError::ExceededMaximumCycles will be raised directly ranther than suspend as expect, and also because script_group execution order is random, so this will happen randomly.

References

github.com/advisories/GHSA-mcmr-49x3-4jqm
github.com/nervosnetwork/ckb
github.com/nervosnetwork/ckb/blob/v0.101.2/script/src/verify.rs
github.com/nervosnetwork/ckb/security/advisories/GHSA-mcmr-49x3-4jqm

Code Behaviors & Features

Detect and mitigate GHSA-mcmr-49x3-4jqm with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →