Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1tZ3Y4LWdnZ3ctbXJnNs4AAzGx

vyper vulnerable to storage allocator overflow

Impact

The storage allocator does not guard against allocation overflows. This can result in vulnerabilities like the following:

owner: public(address)
take_up_some_space: public(uint256[10])
buffer: public(uint256[max_value(uint256)])

@external
def initialize():
    self.owner = msg.sender

@external
def foo(idx: uint256, data: uint256):
    self.buffer[idx] = data

Per @toonvanhove, "An attacker can overwrite the owner variable by calling this contract with calldata: 0x04bc52f8 fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff5 ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff (spaces inserted for readability)
0x04bc52f8 is the selector for foo(uint256, uint256), and the last argument fff...fff is the new value for the owner variable."

Patches

patched in 0bb7203b584e771b23536ba065a6efda457161bb

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

References

Are there any links users can visit to find out more?

Permalink: https://github.com/advisories/GHSA-mgv8-gggw-mrg6
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tZ3Y4LWdnZ3ctbXJnNs4AAzGx
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 12 months ago
Updated: 6 months ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Identifiers: GHSA-mgv8-gggw-mrg6, CVE-2023-30837
References:

• https://github.com/vyperlang/vyper/security/advisories/GHSA-mgv8-gggw-mrg6
• https://nvd.nist.gov/vuln/detail/CVE-2023-30837
• https://github.com/vyperlang/vyper/commit/0bb7203b584e771b23536ba065a6efda457161bb
• https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-76.yaml
• https://github.com/advisories/GHSA-mgv8-gggw-mrg6

Repository: https://github.com/vyperlang/vyper
Blast Radius: 17.8

Affected Packages