PT-2023-26172 · Vyper · Vyper

Charles-Cooper · Published 2023-07-25 · Updated 2023-08-03 · CVE-2023-37902

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Vyper versions prior to 0.3.10

Description The ecrecover precompile in Vyper does not fill the output buffer if the signature does not verify. However, the ecrecover builtin will still return whatever is at memory location 0. This means that if the compiler has been convinced to write to the 0 memory location with specially crafted data just before the ecrecover, a signature check might pass on an invalid signature.

Recommendations For versions prior to 0.3.10, update to version 0.3.10 to resolve the issue. As a temporary workaround, consider restricting the use of the ecrecover builtin until a patch is applied. Avoid using the ecrecover operation with immutable reads or hashmap accesses that could write to the 0 memory location.

Exploit

Fix

Unchecked Return Value

Weakness Enumeration

CWE-252

Related Identifiers

CVE-2023-37902

GHSA-F5X6-7QGP-JHF3

PYSEC-2023-133

Affected Products

Vyper

References · 10

• 🔥 https://github.com/vyperlang/vyper/security/advisories/GHSA-f5x6-7qgp-jhf3 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37902.json · Exploit
• https://github.com/vyperlang/vyper/commit/019a37ab98ff53f04fecfadf602b6cd5ac748f7f · Patch
• https://osv.dev/vulnerability/CVE-2023-37902 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f5x6-7qgp-jhf3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37902 · Security Note
• https://osv.dev/vulnerability/PYSEC-2023-133 · Vendor Advisory
• https://github.com/vyperlang/vyper · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-133.yaml · Note
• https://t.me/cibsecurity/67257 · Telegram Post