Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1jNjQ3LXB4bTItYzUyd84AA1-0
Vyper vulnerable to memory corruption in certain builtins utilizing `msize`
Impact
In certain conditions, the memory used by the builtins raw_call
, create_from_blueprint
and create_copy_of
can be corrupted.
- For
raw_call
, the argument buffer of the call can be corrupted, leading to incorrectcalldata
in the sub-context. - For
create_from_blueprint
andcreate_copy_of
, the buffer for the to-be-deployed bytecode can be corrupted, leading to deploying incorrect bytecode.
Below are the conditions that must be fulfilled for the corruption to happen for each builtin:
raw_call
- memory is not fully initialized, ex. all parameters to an external function live in calldata
and - The
data
argument of the builtin ismsg.data
.
and - The
to
,value
orgas
passed to the builtin is some complex expression that results in writing to uninitialized memory (e.g. calling an internal function)
create_copy_of
- memory is not fully initialized, ex. all parameters to an external function live in calldata
and - The
value
orsalt
passed to the builtin is some complex expression that results in writing to uninitialized memory (e.g. calling an internal function)
create_from_blueprint
- memory is not fully initialized, ex. all parameters to an external function live in calldata
and - Either no constructor parameters are passed to the builtin or
raw_args
is set to True.
and - The
value
orsalt
passed to the builtin is some complex expression that results in writing to uninitialized memory (e.g. calling an internal function)
Note: When the builtin is being called from an internal
function f
from a function g
, the issue is not present provided that g
has written to memory before calling f
.
Examples
raw_call
In the following contract, calling bar(1,1)
will return:
ae42e95100000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff00000001
instead of:
ae42e95100000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000001
identity: constant(address) = 0x0000000000000000000000000000000000000004
@external
def foo():
pass
@internal
@view
def get_address()->address:
a:uint256 = max_value(uint256) # 0xfff...fff
return identity
@external
def bar(f:uint256, u:uint256) -> Bytes[100]:
a: Bytes[100] = raw_call(self.get_address(), msg.data, max_outsize=100)
return a
create_copy_of
In the following contract, after calling test()
, the code deployed at self.created_address
does not match the bytecode at target
.
created_address: public(address)
@external
def test(target: address) -> address:
# The expression in salt= is complex and will require to store to memory
self.created_address = create_copy_of(target, salt = keccak256(_abi_encode(target)))
return self.created_address
create_from_blueprint
In the following contract, after calling test()
, the init bytecode used to create the contract deployed at the address self.created_address
will not match the blueprint bytecode stored at target
.
created_address: public(address)
salt: constant(bytes32) = keccak256("kebab")
@external
@payable
def test(target: address):
# The expression in salt= is complex and will require to store to memory
self.created_address = create_from_blueprint(target, code_offset=0, salt=keccak256(_abi_encode(target)))
Patches
issue tracking in https://github.com/vyperlang/vyper/issues/3609, patched in #3610
Workarounds
The complex expressions that are being passed as kwargs to the builtin should be cached in memory prior to the call to the builtin. For the last example above, it would be:
created_address: public(address)
salt: constant(bytes32) = keccak256("kebab")
@external
@payable
def test(target: address):
salt: bytes32 = keccak256(_abi_encode(target))
self.created_address = create_from_blueprint(target, code_offset=0, salt=salt)
References
Are there any links users can visit to find out more?
Permalink: https://github.com/advisories/GHSA-c647-pxm2-c52wJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jNjQ3LXB4bTItYzUyd84AA1-0
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 1 year ago
Updated: about 2 months ago
CVSS Score: 8.1
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Percentage: 0.00173
EPSS Percentile: 0.54567
Identifiers: GHSA-c647-pxm2-c52w, CVE-2023-42443
References:
- https://github.com/vyperlang/vyper/security/advisories/GHSA-c647-pxm2-c52w
- https://nvd.nist.gov/vuln/detail/CVE-2023-42443
- https://github.com/vyperlang/vyper/issues/3609
- https://github.com/vyperlang/vyper/pull/3610
- https://github.com/vyperlang/vyper/commit/79303fc4fcba06994ee5c6a7baef57bdb185006c
- https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-306.yaml
- https://github.com/advisories/GHSA-c647-pxm2-c52w
Blast Radius: 19.2
Affected Packages
pypi:vyper
Dependent packages: 5Dependent repositories: 236
Downloads: 90,482 last month
Affected Version Ranges: >= 0.3.4, <= 0.3.9
Fixed in: 0.3.10
All affected versions: 0.3.4, 0.3.5, 0.3.6, 0.3.7, 0.3.8, 0.3.9
All unaffected versions: 0.2.1, 0.2.2, 0.2.3, 0.2.4, 0.2.5, 0.2.6, 0.2.7, 0.2.8, 0.2.9, 0.2.10, 0.2.11, 0.2.12, 0.2.13, 0.2.14, 0.2.15, 0.2.16, 0.3.0, 0.3.1, 0.3.2, 0.3.3, 0.3.10, 0.4.0