PT-2023-26172 · Vyper · Vyper

Charles-Cooper · Publicado 2023-07-25 · Atualizado 2023-08-03 · CVE-2023-37902

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Vyper versions prior to 0.3.10

Description The ecrecover precompile in Vyper does not fill the output buffer if the signature does not verify. However, the ecrecover builtin will still return whatever is at memory location 0. This means that if the compiler has been convinced to write to the 0 memory location with specially crafted data just before the ecrecover, a signature check might pass on an invalid signature.

Recommendations For versions prior to 0.3.10, update to version 0.3.10 to resolve the issue. As a temporary workaround, consider restricting the use of the ecrecover builtin until a patch is applied. Avoid using the ecrecover operation with immutable reads or hashmap accesses that could write to the 0 memory location.

Exploit

Correção

Unchecked Return Value

Enumeração de Fraquezas

CWE-252

Identificadores relacionados

CVE-2023-37902

GHSA-F5X6-7QGP-JHF3

PYSEC-2023-133

Produtos afetados

Vyper

Referências · 10

• 🔥 https://github.com/vyperlang/vyper/security/advisories/GHSA-f5x6-7qgp-jhf3 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37902.json · Exploit
• https://github.com/vyperlang/vyper/commit/019a37ab98ff53f04fecfadf602b6cd5ac748f7f · Correção
• https://github.com/vyperlang/vyper · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-133.yaml · Nota
• https://t.me/cibsecurity/67257 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-37902 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-f5x6-7qgp-jhf3 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-37902 · Nota de Segurança
• https://osv.dev/vulnerability/PYSEC-2023-133 · Aviso do Fabricante