Publish GHSA-r56x-j438-vw5m

advisories/github-reviewed/2024/04/GHSA-r56x-j438-vw5m/GHSA-r56x-j438-vw5m.json

@@ -0,0 +1,65 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-r56x-j438-vw5m",
+  "modified": "2024-04-25T19:51:41Z",
+  "published": "2024-04-25T19:51:41Z",
+  "aliases": [
+    "CVE-2024-32646"
+  ],
+  "summary": "vyper performs double eval of the slice args when buffer from adhoc locations",
+  "details": "### Summary\nUsing the `slice` builtin can result in a double eval vulnerability when the buffer argument is either `msg.data`, `self.code` or `<address>.code` and either the `start` or `length` arguments have side-effects.\n\nA contract search was performed and no vulnerable contracts were found in production. Having side-effects in the start and length patterns is also an unusual pattern which is not that likely to show up in user code. It is also much harder (but not impossible!) to trigger the bug since `0.3.4` since the unique symbol fence was introduced (https://github.com/vyperlang/vyper/pull/2914).\n\n### Details\nIt can be seen that the `_build_adhoc_slice_node` function of the `slice` builtin doesn't cache the mentioned arguments to the stack: https://github.com/vyperlang/vyper/blob/4595938734d9988f8e46e8df38049ae0559abedb/vyper/builtins/functions.py#L244\n\nAs such, they can be evaluated multiple times (instead of retrieving the value from the stack).\n\n### PoC\nwith Vyper version `0.3.3+commit.48e326f` the call to `foo` passes the `asserts`:\n```vyper\nl: DynArray[uint256, 10]\n\n@external\ndef foo(cs: String[64]) -> uint256:\n    for i in range(10):\n        self.l.append(1)\n    assert len(self.l) == 10\n    s: Bytes[64] = b\"\"\n    s = slice(msg.data, self.l.pop(), 3)\n    assert len(self.l) == 10 - 2\n    return len(self.l)\n```\n\n### Impact\nNo vulnerable production contracts were found.\n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "vyper"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "0.3.10"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-r56x-j438-vw5m"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32646"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/vyperlang/vyper/pull/2914"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/vyperlang/vyper"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-20"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-04-25T19:51:41Z",
+    "nvd_published_at": "2024-04-25T18:15:08Z"
+  }
+}