GHSA-4v7v-gqf9-ww2g CVE-2020-37287
Vyper: Call stack corruption when passing complex type containing non-base type members as argument
- Severity
- 0.0 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.25%
- Chance of exploitation in the next 30 days. Higher than 16.66% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-682 Incorrect Calculation
- Fix
0.2.6- Upgrade vyper to this version or later
Description
Impact
When we pass a multi-dimensional array (like [[1, 2], [3, 4]]) as an argument to internal/external functions we get incorrect output. This is due to a stack management issue, because it was assumed that the size of each subtype of an array/struct is 32, which is not always correct.
Example code:
@internal
def test_input(arr: int128[2][1], i: int128) -> (int128[2][1], int128):
return arr, i
@external
def test_values(arr: int128[2][1], i: int128) -> (int128[2][1], int128):
return self.test_input(arr, i)
Please see #2183 for further information
Patches
This problem was fixed in #2184, and released as a part of v0.2.6.
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| vyper | < 0.2.6 |
0.2.6 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
vyper PyPI → 0.2.6
- pip
pip install --upgrade "vyper>=0.2.6"- poetry
poetry add "vyper>=0.2.6"- uv
uv add "vyper>=0.2.6"
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- Low
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Weakness
CWE-682: Incorrect Calculation
The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.
How to prevent it
- Implementation: Understand your programming language's underlying representation and how it interacts with numeric calculation. Pay close attention to byte size discrepancies, precision, signed/unsigned distinctions, truncation, conversion and casting between types, "not-a-number" calculations, and how your language handles numbers that are too large or too small for its underlying representation.
- Implementation: Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.
- Implementation: Use the appropriate type for the desired action. For example, in C/C++, only use unsigned types for values that could never be negative, such as height, width, or other numbers related to quantity.
- Architecture and Design: Use languages, libraries, or frameworks that make it easier to handle numbers without unexpected consequences. Examples include safe integer handling packages such as SafeInt (C++) or IntegerLib (C or C++).
- Architecture and Design: Use languages, libraries, or frameworks that make it easier to handle numbers without unexpected consequences. Examples include safe integer handling packages such as SafeInt (C++) or IntegerLib (C or C++).
- Implementation: Examine compiler warnings closely and eliminate problems with potential security implications, such as signed / unsigned mismatch in memory operations, or use of uninitialized variables. Even if the weakness is rarely exploitable, a single failure may lead to the compromise of the entire system.
References
Packages
Other links
- github.com/vyperlang/vyper/security/advisories/GHSA-4v7v-gqf9-ww2g
- github.com/vyperlang/vyper/issues/2183
- github.com/vyperlang/vyper/pull/2184
- github.com/vyperlang/vyper/commit/0be02b7331e8febe79d5a4218829c72e30417a29
- github.com/vyperlang/vyper/releases/tag/v0.2.6
- vulncheck.com/advisories/vyper-before-0.2.6-call-stack-corruption-via-complex-type…
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-2r3x-4mrv-mcxf Vyper: Memory corruption using function calls within tuples / nested calls | Medium | Also affects vyper |
| GHSA-vg88-3v92-rjx2 Vyper: Return inside for loop more than 1 level deep | Low | Also affects vyper |
| GHSA-3vcg-j39x-cwfm Vyper's `slice()` may elide side-effects when output length is 0 | Low | Also affects vyper |
| GHSA-qhr6-mgqr-mchm Vyper's `concat()` builtin may elide side-effects for zero-length arguments | Low | Also affects vyper |
| GHSA-h33q-mhmp-8p67 Vyper has a double eval in For List Iter | High | Also affects vyper |
| GHSA-4w26-8p97-f4jp AugAssign evaluation order causing OOB write within the object in Vyper | Critical | Also affects vyper |
| GHSA-2p94-8669-xg86 Vyper's sqrt doesn't define rounding behavior | High | Also affects vyper |
| GHSA-vgf2-gvx8-xwc3 Vyper Does Not Check the Success of Certain Precompile Calls | High | Also affects vyper |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor