Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1waDl4LTR2YzktbTM5Z84AAzUF

Vyper vulnerable to incorrect ordering of arguments for kwargs passed to internal calls

Impact

Internal calls to internal functions with more than 1 default argument are compiled incorrectly. Depending on the number of arguments
provided in the call, the defaults are added not right-to-left, but left-to-right. If the types are incompatible,
typechecking is bypassed. In the bar() function in the following code, self.foo(13) is compiled to
self.foo(13,12) instead of self.foo(13,1337).

@internal
def foo(a:uint256 = 12, b:uint256 = 1337):
    pass

@internal
def bar():
    self.foo(13)

note that at the time of publication, the ability to pass kwargs to internal functions is an undocumented feature that does not seem to be widely used.

Patches

patched in c3e68c302aa6e1429946473769dd1232145822ac

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

References

Are there any links users can visit to find out more?

Permalink: https://github.com/advisories/GHSA-ph9x-4vc9-m39g
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1waDl4LTR2YzktbTM5Z84AAzUF
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 1 year ago
Updated: about 2 months ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS Percentage: 0.00083
EPSS Percentile: 0.36695

Identifiers: GHSA-ph9x-4vc9-m39g, CVE-2023-32059
References:

• https://github.com/vyperlang/vyper/security/advisories/GHSA-ph9x-4vc9-m39g
• https://nvd.nist.gov/vuln/detail/CVE-2023-32059
• https://github.com/vyperlang/vyper/commit/c3e68c302aa6e1429946473769dd1232145822ac
• https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-79.yaml
• https://github.com/advisories/GHSA-ph9x-4vc9-m39g

Repository: https://github.com/vyperlang/vyper
Blast Radius: 17.8

Affected Packages