From 04a66d3ebba392d062d4a6fdd6d714501d0d59cf Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Mon, 5 Feb 2024 19:23:18 +0000
Subject: [PATCH] Publish GHSA-6845-xw22-ffxv

---
 .../GHSA-6845-xw22-ffxv.json                  | 58 +++++++++++++++++++
 1 file changed, 58 insertions(+)
 create mode 100644 advisories/github-reviewed/2024/02/GHSA-6845-xw22-ffxv/GHSA-6845-xw22-ffxv.json

diff --git a/advisories/github-reviewed/2024/02/GHSA-6845-xw22-ffxv/GHSA-6845-xw22-ffxv.json b/advisories/github-reviewed/2024/02/GHSA-6845-xw22-ffxv/GHSA-6845-xw22-ffxv.json
new file mode 100644
index 00000000000..ed7aec0c9c2
--- /dev/null
+++ b/advisories/github-reviewed/2024/02/GHSA-6845-xw22-ffxv/GHSA-6845-xw22-ffxv.json
@@ -0,0 +1,58 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-6845-xw22-ffxv",
+  "modified": "2024-02-05T19:21:52Z",
+  "published": "2024-02-05T19:21:52Z",
+  "aliases": [
+    "CVE-2024-24559"
+  ],
+  "summary": "Vyper sha3 codegen bug",
+  "details": "### Summary\nThere is an error in the stack management when compiling the `IR` for `sha3_64`. Concretely, the `height` variable is miscalculated.\nThe vulnerability can't be triggered without writing the `IR` by hand. That is, it cannot be triggered from regular vyper code, it can only be triggered by using the `fang` binary directly (this binary used to be called `vyper-ir` prior to v0.3.4).\n\n### Details\nTo compile `sha3_64`, the `arg[0]` and `arg[1]` have to be compiled:\nhttps://github.com/vyperlang/vyper/blob/c150fc49ee9375a930d177044559b83cb95f7963/vyper/ir/compile_ir.py#L585-L586\n\nAs can be seen, after compiling the 0th arg, the `height` variable isn't increased. If new `withargs` are defined in the inner scope, they are manipulated correctly, because both their `height` is off and also the global `height` is off and thus their placement on the stack is computed correctly.\n\n`sha3_64` is used for retrieval in mappings. No flow that would cache the `key` was found, the issue shouldn't be possible to trigger when compiling the compiler-generated `IR`.\n\n### PoC\nSuppose the following hand-written IR:\n```lisp\n(with _loc\n\t(with val 1 \n\t\t(with key 2 \n\t\t\t(sha3_64 val key))) \n\t\t\t\t(seq \n\t\t\t\t\t(sstore _loc \n\t\t\t\t\t(with x (sload _loc) \n\t\t\t\t\t\t(with ans (add x 1) (seq (assert (ge ans x)) ans))))))\n```\nafter compilation:\n```\nthe generated bytecode: 6001600281806020525f5260405f2090509050805460018101818110610026579050815550005b5f80fd\n\n0000    60  PUSH1 0x01\n0002    60  PUSH1 0x02\n0004    81  DUP2\n0005    80  DUP1       *********** bad code here!!!!!!\n0006    60  PUSH1 0x20\n0008    52  MSTORE\n```\n\nIt can be seen that the second `DUP` will dup the item on the top of the stack which is incorrect.\n\n### Impact\nVersions v0.2.0-v0.3.10 were evaluated, and access of the variable with the invalid height is not reachable from IR generated by the vyper front-end. Because the issue isn't triggered during normal compilation of vyper code, the impact is considered low.\n",
+  "severity": [
+
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "vyper"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "0.3.10"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-6845-xw22-ffxv"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/vyperlang/vyper"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/vyperlang/vyper/blob/c150fc49ee9375a930d177044559b83cb95f7963/vyper/ir/compile_ir.py#L585-L586"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "LOW",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-02-05T19:21:52Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file