# GHSA-7225-m954-23v7: ASA-2024-010: cosmossdk.io/math: Mismatched bit-length validation in sdk.Int and sdk.Dec can lead to panic > Attackers can cause a panic in Cosmos SDK chains by exploiting mismatched bit-length validation in math types, leading to denial of service. - **Severity:** Not scored - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Over the internet - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 20 Nov 2024 - **Also known as:** GO-2024-3279 ## What is GHSA-7225-m954-23v7? GHSA-7225-m954-23v7 is a denial of service vulnerability in cosmossdk.io/math, published on 20 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim. ### Official description Name: ASA-2024-010: Mismatched bit-length in `sdk.Int` and `sdk.Dec` can lead to panic Component: Cosmos SDK / Math Criticality: High (Considerable Impact, and Possible Likelihood per [ACMv1.2](https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md)) Affected versions: `cosmossdk.io/math` package versions <= `math/v1.3.0` Affected users: Chain Builders + Maintainers, Validators ### Impact The bit-length in `sdk.Int` and `sdk.Dec` are not aligned, which may present a possible panic condition when interacting with `Dec` types in an `Int` context. This issue was resolved by aligning the max size between the data types in the cosmossdk.io/math package. This issue impacts consumers of the cosmossdk.io/math, which includes popular modules including IBC-Go and tokenfactory (permissionless). If your chain interacts with APIs in the cosmossdk.io/math package, or utilizes a module that consumes this library, it is advised to update to the latest version at the time of the patch release by updating your project's go.mod dependency for cosmossdk.io/math. The patch can be applied without a hard-fork, and with a version bump in a chain's go.mod file like the following: #### `go.mod` ```diff - cosmossdk.io/math v1.3.0 + cosmossdk.io/math v1.4.0 ``` > [!NOTE] > When on a lower version than cosmossdk.io/math v1.3.0, please do a coordinated upgrade before upgrading to >= 1.3.0 ### Patches The new release of `cosmossdk.io/math v1.4.0` resolves this issue. Chains that utilize the cosmossdk.io/math library or modules that utilize the cosmossdk.io/math library should update to avoid this condition. ### Timeline * October 31, 2024, 6:55pm UTC: Issue reported to the Cosmos Bug Bounty program * October 31, 2024, 8:56pm UTC: Issue triaged by Amulet on-call, and distributed to Core team * Nov 15, 2024, 2:12am PST: Core team completes patch for issue * Nov 19, 2024, 8:00am PST / 16:00 GMT: Pre-notification delivered * Nov 20, 2024, 8:00am PST / 16:00 GMT: Patch made available This issue was reported by LonelySloth to the Cosmos Bug Bounty Program on HackerOne on October 31, 2024. If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos. If you have questions about Interchain security efforts, please reach out to our official communication channel at [security@interchain.io](mailto:security@interchain.io). For more information about the Interchain Foundation’s engagement with Amulet, and to sign up for security notification emails, please see https://github.com/interchainio/security. ## Which versions are affected by GHSA-7225-m954-23v7? 3 open source packages ship an affected version, including cosmossdk.io/math. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `cosmossdk.io/math` | Go | All versions | 1.4.0 | | `cosmossdk.io/math` | Go | All versions | 1.4.0 | | `cosmossdk.io/math` | Go | All versions | 1.4.0 | ## How do I fix GHSA-7225-m954-23v7? Upgrade cosmossdk.io/math to 1.4.0 or later. ## Is GHSA-7225-m954-23v7 being exploited? There is no known exploitation of GHSA-7225-m954-23v7 in the wild and no public exploit code. ## Fix prompt for AI coding agents ```text Check this codebase for GHSA-7225-m954-23v7 and fix it if it is affected. What it is: GHSA-7225-m954-23v7 is a denial of service vulnerability in cosmossdk.io/math, published on 20 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim. Exploitation: There is no known exploitation of GHSA-7225-m954-23v7 in the wild and no public exploit code. Affected packages and fixed versions: - cosmossdk.io/math (Go): affected all versions; fixed in 1.4.0 - cosmossdk.io/math (Go): affected all versions; fixed in 1.4.0 - cosmossdk.io/math (Go): affected all versions; fixed in 1.4.0 Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/GHSA-7225-m954-23v7/ (Markdown: https://insights.sbomify.com/GHSA-7225-m954-23v7/index.md) ``` ## Sources - OSV: https://osv.dev/vulnerability/GHSA-7225-m954-23v7 --- From sbomify Insights: https://insights.sbomify.com/GHSA-7225-m954-23v7/ Summaries are generated and may contain mistakes; the official description above is the record.