Postmortem for Kernel Soundness Bug #14576

3 hours ago

A soundness bug in the Lean kernel (#14576) was reported and fixed, involving nested inductive types.
The bug allowed a proof of False via ill-typed arguments in phantom parameters, only reachable through metaprogramming.
Two independent bugs in the official kernel and nanoda checker were needed for the exploit; both have been fixed.
Practical consequence: independent kernel checking requires current versions of both checkers.
lean4lean is affected by the same bug, as it ports the reference implementation.
Removing metaprogramming is misguided; the kernel must reject ill-typed terms independently.
FRO actions include regression tests, kernel hardening, AI-assisted bug finding, and running nanoda by default.

The ntoskrnl-rs project successfully rewrote the Windows NT kernel in Rust, booting in QEMU and passing self-tests.
Claude Fable 5 generated the core kernel (about 5,100 lines) in 38 minutes, including scheduling, memory management, and I/O subsystems.
The kernel loads unmodified Windows drivers and binaries, providing a sandbox for analysis and debugging.

zkao, an AI auditor, found a critical soundness bug in OpenVM's guest library openvm-pairing, allowing a malicious prover to forge any pairing equality.
The bug (CVE-2026-46669) was in the pairing check missing a subfield validation for the scaling factor, enabling forgery by setting scaling factor as the inverse of the Miller loop output.
OpenVM fixed the issue in version 1.6.0 by adding a subfield membership test to reject scaling factors not in the proper subfield.

Bron-crypto's Lindell17 DKG encrypted share computation swapped operands, corrupting threshold ECDSA key shares and causing signing failures.
Poseidon hash.Hash adapter broke Go's contract by resetting state on each Write and misusing Sum for input, resulting in wrong hashes for streaming.
IsOnCurve checks for k256, Pallas, and Vesta were inverted, rejecting valid points and accepting invalid ones, enabling invalid-curve attacks.

Closed AI models refuse to help with a Linux bug, highlighting open source advantages.
Intel's Optane memory, ideal for AI workloads, is gone before its potential was realized.
MCP gets an enterprise makeover for easier lifecycle management in K8s environments.

The ntoskrnl-rs project successfully rewrote the Windows NT kernel in Rust, booting in QEMU and passing self-tests.
Claude Fable 5 generated the core kernel (about 5,100 lines) in 38 minutes, including scheduling, memory management, and I/O subsystems.
The kernel loads unmodified Windows drivers and binaries, providing a sandbox for analysis and debugging.

zkao, an AI auditor, found a critical soundness bug in OpenVM's guest library openvm-pairing, allowing a malicious prover to forge any pairing equality.
The bug (CVE-2026-46669) was in the pairing check missing a subfield validation for the scaling factor, enabling forgery by setting scaling factor as the inverse of the Miller loop output.
OpenVM fixed the issue in version 1.6.0 by adding a subfield membership test to reject scaling factors not in the proper subfield.

Bron-crypto's Lindell17 DKG encrypted share computation swapped operands, corrupting threshold ECDSA key shares and causing signing failures.
Poseidon hash.Hash adapter broke Go's contract by resetting state on each Write and misusing Sum for input, resulting in wrong hashes for streaming.
IsOnCurve checks for k256, Pallas, and Vesta were inverted, rejecting valid points and accepting invalid ones, enabling invalid-curve attacks.

Closed AI models refuse to help with a Linux bug, highlighting open source advantages.
Intel's Optane memory, ideal for AI workloads, is gone before its potential was realized.
MCP gets an enterprise makeover for easier lifecycle management in K8s environments.

Hasty Briefsbeta