Skip to content

Vyper sha3 codegen bug

Low severity GitHub Reviewed Published Feb 5, 2024 in vyperlang/vyper • Updated Jun 18, 2024

Package

pip vyper (pip)

Affected versions

< 0.4.0

Patched versions

0.4.0

Description

Summary

There is an error in the stack management when compiling the IR for sha3_64. Concretely, the height variable is miscalculated.
The vulnerability can't be triggered without writing the IR by hand. That is, it cannot be triggered from regular vyper code, it can only be triggered by using the fang binary directly (this binary used to be called vyper-ir prior to v0.3.4).

Details

To compile sha3_64, the arg[0] and arg[1] have to be compiled:
https://github.com/vyperlang/vyper/blob/c150fc49ee9375a930d177044559b83cb95f7963/vyper/ir/compile_ir.py#L585-L586

As can be seen, after compiling the 0th arg, the height variable isn't increased. If new withargs are defined in the inner scope, they are manipulated correctly, because both their height is off and also the global height is off and thus their placement on the stack is computed correctly.

sha3_64 is used for retrieval in mappings. No flow that would cache the key was found, the issue shouldn't be possible to trigger when compiling the compiler-generated IR.

PoC

Suppose the following hand-written IR:

(with _loc
	(with val 1 
		(with key 2 
			(sha3_64 val key))) 
				(seq 
					(sstore _loc 
					(with x (sload _loc) 
						(with ans (add x 1) (seq (assert (ge ans x)) ans))))))

after compilation:

the generated bytecode: 6001600281806020525f5260405f2090509050805460018101818110610026579050815550005b5f80fd

0000    60  PUSH1 0x01
0002    60  PUSH1 0x02
0004    81  DUP2
0005    80  DUP1       *********** bad code here!!!!!!
0006    60  PUSH1 0x20
0008    52  MSTORE

It can be seen that the second DUP will dup the item on the top of the stack which is incorrect.

Patches

Patched in vyperlang/vyper#4063.

Impact

Versions v0.2.0-v0.3.10 were evaluated, and access of the variable with the invalid height is not reachable from IR generated by the vyper front-end. Because the issue isn't triggered during normal compilation of vyper code, the impact is considered low.

References

@charles-cooper charles-cooper published to vyperlang/vyper Feb 5, 2024
Published to the GitHub Advisory Database Feb 5, 2024
Reviewed Feb 5, 2024
Published by the National Vulnerability Database Feb 5, 2024
Last updated Jun 18, 2024

Severity

Low

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
High
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS score

0.046%
(18th percentile)

Weaknesses

CVE ID

CVE-2024-24559

GHSA ID

GHSA-6845-xw22-ffxv

Source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.