# GHSA-jp37-5qhw-mffw: Sharks has a Bias of Polynomial Coefficients in Secret Sharing

> A bias in polynomial coefficient generation allows attackers to recover shared secrets if the same secret is shared multiple times, compromising confidentiality.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Not stated
- **Victim action needed:** Not needed
- **Fix available:** No
- **Published:** 16 Nov 2024
- **Also known as:** RUSTSEC-2024-0398

## What is GHSA-jp37-5qhw-mffw?

GHSA-jp37-5qhw-mffw is a vulnerability in sharks, published on 16 Nov 2024. 

### Official description

Affected versions of this crate allowed for a bias when generating random polynomials for Shamir Secret Sharing, where instead of being within the range `[0, 255]` they were instead in the range `[1, 255]`. A description from Cure53, who originally found the issue, is available:

> The correct method to select a random polynomial would be to select all coefficients (including the most significant coefficient) uniformly in the range 0..255 (inclusive). Otherwise, knowledge that a coefficient in a polynomial cannot be 0 permits the exclusion of single byte values for the shared secret given one share less than required. [...] Exploiting this weakness necessitates sharing the same secret multiple times. In this scenario, an attacker could exclude an exponential number of values for each of the shared bytes until sufficiently few values remain for brute forcing.  Cure53 estimates that under ideal circumstances (e.g., a 2-out-of-N scheme) a shared secret can be reconstructed if the same secret has been distributed 500-1500 times.

Secrets that have been shared a low amount of times (ideally, once) would not be impacted. However, secrets that are repeatedly shared may be vulnerable, especially if the shares are still available, and should be rotated.

The vulnerability does not impact reconstitution of secrets: secrets that have already been split can be recombined without issue.

The flaw can be corrected by changing the lower bound of the polynomial coefficient range in the `sharks::math::random_polynomial` function to `0`. The `blahaj` crate has been made available with a fixed version of the code, after attempts to reach the maintainer of the `sharks` crate were unsuccessful.

## Which versions are affected by GHSA-jp37-5qhw-mffw?

3 open source packages ship an affected version, including sharks.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `sharks` | crates.io | All versions to 0.5.0 | None |
| `sharks` | crates.io | All versions to 0.5.0 | None |
| `sharks` | crates.io | From 0.0.0-0 | None |

## How do I fix GHSA-jp37-5qhw-mffw?

No fix has been published for GHSA-jp37-5qhw-mffw yet. Limit exposure of the affected software until one is available.

## Is GHSA-jp37-5qhw-mffw being exploited?

There is no known exploitation of GHSA-jp37-5qhw-mffw in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-jp37-5qhw-mffw and fix it if it is affected.

What it is: GHSA-jp37-5qhw-mffw is a vulnerability in sharks, published on 16 Nov 2024. 
Exploitation: There is no known exploitation of GHSA-jp37-5qhw-mffw in the wild and no public exploit code.

Affected packages and fixed versions:
- sharks (crates.io): affected all versions up to 0.5.0; no fix listed
- sharks (crates.io): affected all versions up to 0.5.0; no fix listed
- sharks (crates.io): affected from 0.0.0-0; no fix listed

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-jp37-5qhw-mffw/ (Markdown: https://insights.sbomify.com/GHSA-jp37-5qhw-mffw/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-jp37-5qhw-mffw

---
From sbomify Insights: https://insights.sbomify.com/GHSA-jp37-5qhw-mffw/
Summaries are generated and may contain mistakes; the official description above is the record.