Lean 4 内核漏洞 CVE-2024-14484 推理缓存投毒及证明

漏洞概述 漏洞名称: Lean 4 Kernel Soundness Bug — Inference Cache Poisoning 漏洞编号: CVE-2024-14484 漏洞类型: CWE-488 (Exposure of Data Element to Wrong Session), CWE-20 (Improper Input Validation) 漏洞描述: Lean 4 内核的 路径未调用 ，导致在声明体中未进行闭包检查。攻击者可以通过构造特定的类型表达式，利用推断缓存中的陈旧条目，从而绕过类型检查，实现内核接受的 类型常量，进而证明 。 影响范围 受影响版本: Lean 4 ≤ v4.31.0 及所有先前版本 修复版本: nightly 2026-07-23+，回溯至 v4.32.1 和 v4.33.0 CVSS 3.1: AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:N — 7.1 影响系统: 任何信任 Lean 内核检查证明为真实性的系统，包括形式化验证软件、密码学库、智能合约、航空、汽车等安全关键系统。 影响代码: 恶意依赖可以在 Lake 包中静默引入不正确的声明，影响下游代码使用。 独立检查器: 报告者确认 回放也接受此利用。比较器导出格式无法表达 ，因此验证路径不受影响。 AI 生成证明: 使用 Lean 作为可信后端的系统（如 AlphaProof、DeepSeek-Prover 和 Kimina-Prover）可能产生利用内核漏洞的证明。 修复方案 修复提交: leangprover/lean4#14498 修复内容: 在 函数中添加闭包检查，确保在类型检查之前对值进行验证。 POC 代码 git clone https://github.com/leanprover/lean4.git cd lean4 make -j8 lake exe cache get lake build lake run -- -trust=0 src/lean4/examples/CachePoisonFalse.lean git clone https://github.com/leanprover/lean4.git cd lean4 make -j8 lake exe cache get lake build lake run -- -trust=0 src/lean4/examples/CachePoisonFalse.lean git clone https://github.com/leanprover/lean4.git cd lean4 make -j8 lake exe cache get lake build lake run -- -trust=0 src/lean4/examples/CachePoisonFalse.lean git clone https://github.com/leanprover/lean4.git cd lean4 make -j8 lake exe cache get lake build lake run -- -trust=0 src/lean4/examples/CachePoisonFalse.lean git clone https://github.com/leanprover/lean4.git cd lean4 make -j8 lake exe cache get lake build lake run -- -trust=0 src/lean4/examples/CachePoisonFalse.lean git clone https://github.com/leanprover/lean4.git cd lean4 make -j8 lake exe cache get lake build lake run -- -trust=0 src/lean4/examples/CachePoisonFalse.lean git clone https://github.com/leanprover/lean4.git cd lean4 make -j8 lake exe cache get lake build lake run -- -trust=0 src/lean4/examples/CachePoisonFalse.lean git clone https://github.com/leanprover/lean4.git cd lean4 make -j8 lake exe cache get lake build lake run -- -trust=0 src/lean4/examples/CachePoisonFalse.lean git clone https://github.com/leanprover/lean4.git cd lean4 make -j8 lake exe cache get lake build lake run -- -trust=0 src/lean4/examples/CachePoisonFalse.lean git clone https://github.com/leanprover/lean4.git cd lean4 make -j8 lake exe cache get lake build lake run -- -trust=0 src/lean4/examples/CachePoisonFalse.lean ``` Expected Output The proof should fail with a soundness error, indicating that the kernel has accepted an invalid proof. Notes This proof relies on a specific bug in Lean 4's kernel. The bug has been fixed in the latest nightly build. To verify the fix, run the proof on a patched version of Lean 4. References [Lean 4 GitHub Repository](https://github.com/leanprover/lean4

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

Lean 4 内核漏洞 CVE-2024-14484 推理缓存投毒及证明

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

Lean 4 内核漏洞 CVE-2024-14484 推理缓存投毒及证明

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！