PT-2018-14720 · Python · Py-Evm
Renardbebe
·
Publicado
2018-11-12
·
Atualizado
2019-02-04
·
CVE-2018-18920
CVSS v3.1
8.8
Alta
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Py-EVM version 0.2.0-alpha.33
Description
The issue allows attackers to make a
vm.execute bytecode call that triggers computation with a stack containing values like 100, 100, 0 where a specific byte b'x' was expected, resulting in an execution failure due to an invalid opcode. This is related to the execution of smart contracts without paying gas, potentially allowing them to run indefinitely.Recommendations
For Py-EVM version 0.2.0-alpha.33, as a temporary workaround, consider restricting the
vm.execute bytecode call to prevent the execution of smart contracts with invalid opcodes until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Py-Evm