Skip to content
Log inStart free trial

GHSA-9vx6-7xxf-x967 CVE-2024-27094

OpenZeppelin Contracts base64 encoding may read from potentially dirty memory

High npm
Severity
6.5 / 10
High · CVSS 3.1
Exploit chance (EPSS)
0.76%
Chance of exploitation in the next 30 days. Higher than 55.40% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-125 Out-of-bounds Read
Fix
Available
2 packages have a fixed version

Description

Impact

The Base64.encode function encodes a bytes input by iterating over it in chunks of 3 bytes. When this input is not a multiple of 3, the last iteration may read parts of the memory that are beyond the input buffer.

Although the encode function pads the output for these cases, up to 4 bits of data are kept between the encoding and padding, corrupting the output if these bits were dirty (i.e. memory after the input is not 0). These conditions are more frequent in the following scenarios:

  • A bytes memory struct is allocated just after the input and the first bytes of it are non-zero.
  • The memory pointer is set to a non-empty memory location before allocating the input.

Developers should evaluate whether the extra bits can be maliciously manipulated by an attacker.

Patches

Upgrade to 5.0.2 or 4.9.6.

References

This issue was reported by the Independent Security Researcher Riley Holterhus through Immunefi (@rileyholterhus on X)

Affected versions

npm

PackageVulnerableFixed in
@openzeppelin/contracts
>= 4.5.0, < 4.9.6
4.9.6
@openzeppelin/contracts
>= 5.0.0-rc.0, < 5.0.2
5.0.2
@openzeppelin/contracts-upgradeable
>= 5.0.0-rc.0, < 5.0.2
5.0.2
@openzeppelin/contracts-upgradeable
>= 4.5.0, < 4.9.6
4.9.6

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

@openzeppelin/contracts npm → 4.9.6

npm
npm install @openzeppelin/contracts@4.9.6
yarn
yarn add @openzeppelin/contracts@4.9.6
pnpm
pnpm add @openzeppelin/contracts@4.9.6

@openzeppelin/contracts-upgradeable npm → 5.0.2

npm
npm install @openzeppelin/contracts-upgradeable@5.0.2
yarn
yarn add @openzeppelin/contracts-upgradeable@5.0.2
pnpm
pnpm add @openzeppelin/contracts-upgradeable@5.0.2

Severity breakdown

CVSS 3.1 6.5

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

Attack vector
Network
Attack complexity
High
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
High

Weakness

CWE-125: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How to prevent it
  • Implementation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright. To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.
  • Architecture and Design: Use a language that provides appropriate memory abstractions.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-9rcw-c2f9-2j55
OpenZeppelin Contracts Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffers
Medium Also affects @openzeppelin/contracts
GHSA-699g-q6qh-q4v8
OpenZeppelin Contracts and Contracts Upgradeable duplicated execution of subcalls in v4.9.4
High Also affects @openzeppelin/contracts
GHSA-g4vp-m682-qqmp
OpenZeppelin Contracts vulnerable to Improper Escaping of Output
Medium Also affects @openzeppelin/contracts
GHSA-wprv-93r4-jj2p
OpenZeppelin Contracts using MerkleProof multiproofs may allow proving arbitrary leaves for specific trees
Medium Also affects @openzeppelin/contracts
GHSA-5h3x-9wvq-w4m2
OpenZeppelin Contracts's governor proposal creation may be blocked by frontrunning
Medium Also affects @openzeppelin/contracts
GHSA-mx2q-35m2-x2rh
OpenZeppelin Contracts TransparentUpgradeableProxy clashing selector calls may not be delegated
Medium Also affects @openzeppelin/contracts
GHSA-93hq-5wgc-jc82
GovernorCompatibilityBravo may trim proposal calldata
High Also affects @openzeppelin/contracts
GHSA-878m-3g6q-594q
OpenZeppelin Contracts contains Incorrect Calculation
Medium Also affects @openzeppelin/contracts
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor