mirror of
https://github.com/netbirdio/advisory-database.git
synced 2026-05-22 18:04:22 -07:00
Publish Advisories
GHSA-3whq-64q2-qfj6 GHSA-5jrj-52x8-m64h GHSA-m2v9-w374-5hj9
This commit is contained in:
advisory-database[bot]
@@ -0,0 +1,65 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-3whq-64q2-qfj6",
|
||||
"modified": "2024-04-25T19:50:50Z",
|
||||
"published": "2024-04-25T19:50:50Z",
|
||||
"aliases": [
|
||||
"CVE-2024-32647"
|
||||
],
|
||||
"summary": "vyper performs double eval of raw_args in create_from_blueprint",
|
||||
"details": "### Summary\nUsing the `create_from_blueprint` builtin can result in a double eval vulnerability when `raw_args=True` and the `args` argument has side-effects. \n\nA contract search was performed and no vulnerable contracts were found in production. In particular, the `raw_args` variant of `create_from_blueprint` was not found to be used in production.\n\n### Details\nIt can be seen that the `_build_create_IR` function of the `create_from_blueprint` builtin doesn't cache the mentioned `args` argument to the stack: https://github.com/vyperlang/vyper/blob/cedf7087e68e67c7bfbd47ae95dcb16b81ad2e02/vyper/builtins/functions.py#L1847\n\nAs such, it can be evaluated multiple times (instead of retrieving the value from the stack).\n\n### PoC\nThe vulnerability is demonstrated in the following `boa` test:\n``` vyper\nsrc1 = \"\"\"\nc: uint256\n\"\"\"\ndeployer = \"\"\"\ncreated_address: public(address)\ndeployed: public(uint256)\n\n@external\ndef get() -> Bytes[32]:\n self.deployed += 1\n return b''\n\n@external\ndef create_(target: address):\n self.created_address = create_from_blueprint(target, raw_call(self, method_id(\"get()\"), max_outsize=32), raw_args=True, code_offset=3)\n\"\"\"\n\nFactory = b.loads_partial(src1)\nc = Factory.deploy_as_blueprint()\n\nc2 = b.loads(deployer, b'')\nc2.create_(c)\nc2.deployed()\n```\nThe output of `c2.deployed()` is `2` although `create_` was called only once and the value was initialized to `0`.\n\n### Impact\nNo vulnerable production contracts were found. Additionally, double evaluation of side-effects should be easily discoverable in client tests. As such, the impact is `low`.\n",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "PyPI",
|
||||
"name": "vyper"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "0"
|
||||
},
|
||||
{
|
||||
"last_affected": "0.3.10"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-3whq-64q2-qfj6"
|
||||
},
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32647"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/vyperlang/vyper"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/vyperlang/vyper/blob/cedf7087e68e67c7bfbd47ae95dcb16b81ad2e02/vyper/builtins/functions.py#L1847"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-95"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-04-25T19:50:50Z",
|
||||
"nvd_published_at": "2024-04-25T18:15:08Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,65 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-5jrj-52x8-m64h",
|
||||
"modified": "2024-04-25T19:50:16Z",
|
||||
"published": "2024-04-25T19:50:16Z",
|
||||
"aliases": [
|
||||
"CVE-2024-32649"
|
||||
],
|
||||
"summary": "vyper performs double eval of the argument of sqrt",
|
||||
"details": "### Summary\nUsing the `sqrt` builtin can result in multiple eval evaluation of side effects when the argument has side-effects. The bug is more difficult (but not impossible!) to trigger as of 0.3.4, when the unique symbol fence was introduced (https://github.com/vyperlang/vyper/pull/2914).\n\nA contract search was performed and no vulnerable contracts were found in production.\n\n### Details\nIt can be seen that the `build_IR` function of the `sqrt` builtin doesn't cache the argument to the stack: \nhttps://github.com/vyperlang/vyper/blob/4595938734d9988f8e46e8df38049ae0559abedb/vyper/builtins/functions.py#L2151\n\nAs such, it can be evaluated multiple times (instead of retrieving the value from the stack).\n\n### PoC\nWith at least Vyper version `0.2.15+commit.6e7dba7` the following contract:\n```vyper\nc: uint256\n\n@internal\ndef some_decimal() -> decimal:\n self.c += 1\n return 1.0\n\n@external\ndef foo() -> uint256:\n k: decimal = sqrt(self.some_decimal())\n return self.c\n```\npasses the following test:\n```solidity\n// SPDX-License-Identifier: MIT\npragma solidity >=0.8.13;\n\nimport \"../../lib/ds-test/test.sol\";\nimport \"../../lib/utils/Console.sol\";\nimport \"../../lib/utils/VyperDeployer.sol\";\n\nimport \"../ITest.sol\";\n\ncontract ConTest is DSTest {\n VyperDeployer vyperDeployer = new VyperDeployer();\n\n ITest t;\n\n function setUp() public {\n t = ITest(vyperDeployer.deployContract(\"Test\"));\n }\n\n function testFoo() public {\n uint256 val = t.foo();\n console.log(val);\n assert (val == 4);\n }\n}\n```\n \n\n### Impact\nNo vulnerable production contracts were found.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "PyPI",
|
||||
"name": "vyper"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "0"
|
||||
},
|
||||
{
|
||||
"last_affected": "0.3.10"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-5jrj-52x8-m64h"
|
||||
},
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32649"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/vyperlang/vyper/pull/2914"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/vyperlang/vyper"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-95"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-04-25T19:50:16Z",
|
||||
"nvd_published_at": "2024-04-25T18:15:09Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,72 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-m2v9-w374-5hj9",
|
||||
"modified": "2024-04-25T19:50:35Z",
|
||||
"published": "2024-04-25T19:50:35Z",
|
||||
"aliases": [
|
||||
"CVE-2024-32648"
|
||||
],
|
||||
"summary": "vyper default functions don't respect nonreentrancy keys",
|
||||
"details": "### Summary\nPrior to v0.3.0, `__default__()` functions did not respect the `@nonreentrancy` decorator and the lock was not emitted. This is a known bug and was already visible in the issue tracker (https://github.com/vyperlang/vyper/issues/2455), but it is being re-issued as an advisory so that tools relying on the advisory publication list can incorporate it into their searches.\n\nA contract search was additionally performed and no vulnerable contracts were found in production.\n\n### PoC\n```vyper\n@external\n@payable\n@nonreentrant(\"default\")\ndef __default__():\n pass\n```\n\nafter codegen:\n```\n[seq,\n [if, [lt, calldatasize, 4], [goto, fallback]],\n [mstore, 28, [calldataload, 0]],\n [with, _func_sig, [mload, 0], seq],\n [seq_unchecked,\n [label, fallback],\n [seq,\n pass,\n # Line 5\n pass,\n pass,\n # Line 4\n stop]]],\n```\n\n### Impact\nNo vulnerable production contracts were found. Additionally, using a lock on a `default` function is a very sparsely used pattern. As such, the impact is `low`.\n",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "PyPI",
|
||||
"name": "vyper"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "0"
|
||||
},
|
||||
{
|
||||
"fixed": "0.3.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"last_known_affected_version_range": "<= 0.2.16"
|
||||
}
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-m2v9-w374-5hj9"
|
||||
},
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32648"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/vyperlang/vyper/issues/2455"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/vyperlang/vyper/commit/93287e5ac184b53b395c907d40701f721daf8177"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/vyperlang/vyper"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-667"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-04-25T19:50:35Z",
|
||||
"nvd_published_at": "2024-04-25T18:15:09Z"
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user