netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish GHSA-4hwq-4cpm-8vmx

Browse Source
This commit is contained in:
advisory-database[bot]
2024-10-09 19:32:38 +00:00
parent 4a2d928c88
commit 00a38fe635
1 changed files with 11 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/02/GHSA-4hwq-4cpm-8vmx/GHSA-4hwq-4cpm-8vmx.json
+11 -4
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4hwq-4cpm-8vmx",
"modified": "2024-02-26T22:06:39Z",
"modified": "2024-10-09T19:31:00Z",
"published": "2024-02-26T20:11:35Z",
"aliases": [
"CVE-2024-24564"
],
"summary": "Vyper's `extract32` can ready dirty memory",
"details": "### Summary\n\nWhen using the built-in `extract32(b, start)`, if the `start` index provided has for side effect to update `b`, the byte array to extract `32` bytes from, it could be that some dirty memory is read and returned by `extract32`.\n\n### Details\n\nBefore evaluating `start`, the function `Extract32.build_IR` caches only:\n\n- The pointer in memory/storage to `b`: https://github.com/vyperlang/vyper/blob/10564dcc37756f3d3684b7a91fd8f4325a38c4d8/vyper/builtins/functions.py#L916-L918\n- The length of `b`: https://github.com/vyperlang/vyper/blob/10564dcc37756f3d3684b7a91fd8f4325a38c4d8/vyper/builtins/functions.py#L920-L922\n\nbut do not cache the actual content of `b`. This means that if the evaluation of `start` changes `b`'s content and length, an outdated length will be used with the new content when extracting 32 bytes from `b`.\n\n### PoC\n\nCalling the function `foo` of the following contract returns `b'uuuuuuuuuuuuuuuuuuuuuuuuuuu\\x00\\x00789'` meaning that `extract32` accessed some dirty memory.\n\n```Vyper\nvar:Bytes[96]\n\n@internal\ndef bar() -> uint256:\n self.var = b'uuuuuuuuuuuuuuuuuuuuuuuuuuuuuu'\n self.var = b''\n return 3\n\n@external\ndef foo() -> bytes32:\n self.var = b'abcdefghijklmnopqrstuvwxyz123456789'\n return extract32(self.var, self.bar(), output_type=bytes32)\n # returns b'uuuuuuuuuuuuuuuuuuuuuuuuuuu\\x00\\x00789'\n```\n\n### Impact\n\nFor contracts that are affected, it means that calling `extract32` returns dirty memory bytes instead of some expected output.",
"details": "### Summary\n\nWhen using the built-in `extract32(b, start)`, if the `start` index provided has for side effect to update `b`, the byte array to extract `32` bytes from, it could be that some dirty memory is read and returned by `extract32`.\n\nAs of v0.4.0 (specifically, commit https://github.com/vyperlang/vyper/commit/3d9c537142fb99b2672f21e2057f5f202cde194f), the compiler will panic instead of generating bytecode.\n\n### Details\n\nBefore evaluating `start`, the function `Extract32.build_IR` caches only:\n\n- The pointer in memory/storage to `b`: https://github.com/vyperlang/vyper/blob/10564dcc37756f3d3684b7a91fd8f4325a38c4d8/vyper/builtins/functions.py#L916-L918\n- The length of `b`: https://github.com/vyperlang/vyper/blob/10564dcc37756f3d3684b7a91fd8f4325a38c4d8/vyper/builtins/functions.py#L920-L922\n\nbut do not cache the actual content of `b`. This means that if the evaluation of `start` changes `b`'s content and length, an outdated length will be used with the new content when extracting 32 bytes from `b`.\n\n### PoC\n\nCalling the function `foo` of the following contract returns `b'uuuuuuuuuuuuuuuuuuuuuuuuuuu\\x00\\x00789'` meaning that `extract32` accessed some dirty memory.\n\n```Vyper\nvar:Bytes[96]\n\n@internal\ndef bar() -> uint256:\n self.var = b'uuuuuuuuuuuuuuuuuuuuuuuuuuuuuu'\n self.var = b''\n return 3\n\n@external\ndef foo() -> bytes32:\n self.var = b'abcdefghijklmnopqrstuvwxyz123456789'\n return extract32(self.var, self.bar(), output_type=bytes32)\n # returns b'uuuuuuuuuuuuuuuuuuuuuuuuuuu\\x00\\x00789'\n```\n\n### Impact\n\nFor contracts that are affected, it means that calling `extract32` returns dirty memory bytes instead of some expected output.",
"severity": [
{
"type": "CVSS_V3",
@@ -28,11 +28,14 @@
"introduced": "0"
},
{
"last_affected": "0.3.10"
"fixed": "0.4.0"
}
]
}
]
],
"database_specific": {
"last_known_affected_version_range": "<= 0.3.10"
}
}
],
"references": [
@@ -44,6 +47,10 @@
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24564"
},
{
"type": "WEB",
"url": "https://github.com/vyperlang/vyper/commit/3d9c537142fb99b2672f21e2057f5f202cde194f"
},
{
"type": "PACKAGE",
"url": "https://github.com/vyperlang/vyper"