PT-2023-33060 · Unknown+1 · Ethereum Abi Decoder+1

Publicado 2023-11-24 · Atualizado 2023-11-24

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Ethereum ABI decoder (affected versions not specified)

Description A potential denial-of-service (DoS) vector exists in the Ethereum ABI decoder due to the specification allowing zero-sized-types (ZST). This can cause excessive resource consumption when parsing a malicious payload and schema. The issue arises when a parser expects an array of ZST, attempting to parse as many ZST as the byte array claims to contain, potentially leading to a DoS. The Ethereum ABI specification could have disallowed ZST completely, but it is still allowed, even though the latest versions of Solidity and Vyper do not permit defining ZST like empty tuples or empty arrays.

Recommendations As a temporary workaround, consider disabling the parsing of zero-sized-types (ZST) in the Ethereum ABI decoder until a patch is available. Restrict access to the vulnerable decode function in the eth abi library to minimize the risk of exploitation. Avoid using the decode function with schemata that include dynamic arrays of ZST, such as ()[] or uint32[0][], until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

GHSA-RQR8-PXH7-CQ3G

Produtos afetados

Ethereum Abi Decoder

Eth Abi

Referências · 3

• https://github.com/ethereum/eth-abi · Nota
• https://github.com/ethereum/eth-abi/security/advisories/GHSA-rqr8-pxh7-cq3g · Nota
• https://osv.dev/vulnerability/GHSA-rqr8-pxh7-cq3g · Aviso do Fabricante