Skip to content
Log inStart free trial

GHSA-5824-cm3x-3c38 CVE-2023-39363 PYSEC-2023-142

Vyper has incorrectly allocated named re-entrancy locks

High PyPI
Severity
0.0 / 10
High · CVSS 4.0
Exploit chance (EPSS)
0.82%
Chance of exploitation in the next 30 days. Higher than 57.31% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-863 Incorrect Authorization
Fix
0.3.1
Upgrade vyper to this version or later

Description

Impact

In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in contracts compiled with the susceptible versions. A specific set of conditions is required to result in misbehavior of affected contracts, specifically:

  • A .vy contract compiled with either of the following vyper versions: 0.2.15, 0.2.16, 0.3.0
  • A primary function that utilizes the @nonreentrant decorator with a specific key and does not strictly follow the check-effects-interaction pattern (i.e. contains an external call to an untrusted party before storage updates)
  • A secondary function that utilizes the same key and would be affected by the improper state caused by the primary function

Patches

https://github.com/vyperlang/vyper/pull/2439, https://github.com/vyperlang/vyper/pull/2514

Workarounds

Upgrade to 0.3.1 or higher

References

Technical post-mortem report: https://hackmd.io/@vyperlang/HJUgNMhs2

Affected versions

PyPI

PackageVulnerableFixed in
vyper
>= 0.2.15, < 0.3.1
0.3.1
vyper
all versions
 No fix yet

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

vyper PyPI → 0.3.1

pip
pip install --upgrade "vyper>=0.3.1"
poetry
poetry add "vyper>=0.3.1"
uv
uv add "vyper>=0.3.1"

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:A

Attack vector
Network
Attack complexity
Low
Attack requirements
Present
Privileges required
None
User interaction
None
Confidentiality (vulnerable system)
None
Integrity (vulnerable system)
High
Availability (vulnerable system)
High
Confidentiality (subsequent systems)
None
Integrity (subsequent systems)
High
Availability (subsequent systems)
High
Exploit maturity
Attacked

CVSS 3.1 8.7

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H

Attack vector
Network
Attack complexity
High
Privileges required
None
User interaction
None
Scope
Changed
Confidentiality
None
Integrity
High
Availability
High

Weakness

CWE-863: Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

How to prevent it
  • Architecture and Design: Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
  • Architecture and Design: Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
  • Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
  • Architecture and Design: For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page. One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
  • System Configuration, Installation: Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-2r3x-4mrv-mcxf
Vyper: Memory corruption using function calls within tuples / nested calls
Medium Also affects vyper
GHSA-4v7v-gqf9-ww2g
Vyper: Call stack corruption when passing complex type containing non-base type members as argument
Medium Also affects vyper
GHSA-vg88-3v92-rjx2
Vyper: Return inside for loop more than 1 level deep
Low Also affects vyper
GHSA-3vcg-j39x-cwfm
Vyper's `slice()` may elide side-effects when output length is 0
Low Also affects vyper
GHSA-qhr6-mgqr-mchm
Vyper's `concat()` builtin may elide side-effects for zero-length arguments
Low Also affects vyper
GHSA-h33q-mhmp-8p67
Vyper has a double eval in For List Iter
High Also affects vyper
GHSA-4w26-8p97-f4jp
AugAssign evaluation order causing OOB write within the object in Vyper
Critical Also affects vyper
GHSA-2p94-8669-xg86
Vyper's sqrt doesn't define rounding behavior
High Also affects vyper
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor