CVE-2023-46247: Vyper Incorrect Storage Layout For Contracts Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-6m97-7527-mh74",
  "modified" : "2024-11-22T20:41:02Z",
  "published" : "2023-12-13T13:18:52Z",
  "aliases" : [ "CVE-2023-46247" ],
  "summary" : "incorrect storage layout for contracts containing large arrays",
  "details" : "### Impact\ncontracts containing large arrays might underallocate the number of slots they need. prior to v0.3.8, the calculation to determine how many slots a storage variable needed used `math.ceil(type_.size_in_bytes / 32)`:\n\nhttps://github.com/vyperlang/vyper/blob/6020b8bbf66b062d299d87bc7e4eddc4c9d1c157/vyper/semantics/validation/data_positions.py#L197\n\nthe intermediate floating point step can produce a rounding error if there are enough bits set in the IEEE-754 mantissa. roughly speaking, if `type_.size_in_bytes` is large (> 2**46), and slightly less than a power of 2, the calculation can overestimate how many slots are needed. if `type_.size_in_bytes` is slightly more than a power of 2, the calculation can underestimate how many slots are needed.\n\nthe following two example contracts can result in overwriting of the variable `vulnerable`:\n```vyper\nlarge_array: address[2**64 + 1]  # type_.size_in_bytes == 32 * (2**64 + 1); math.ceil(type_.size_in_bytes / 32) < 2**64 + 1\nvulnerable: uint256\n\n# writing to self.large_array[2**64] will overwrite self.vulnerable\n```\n```vyper\nlarge_dynarray: DynArray[address, 2**64]  # Dynarray has a length word in front, its size in bytes is 32 * (2**64 + 1)\nvulnerable: uint256\n\n# writing to self.large_dynarray[2**64 - 1] will overwrite self.vulnerable\n```\n\nnote that in the latter case, the risk of `vulnerable` being overwritten is relatively small, since it would cost roughly $1.45 million trillion USD at today's gas prices (gas price 20gwei, ETH ~= $1800) in order to extend the DynArray to its full container size.\n\n### Patches\npatched by v0.3.8, specifically in commit https://github.com/vyperlang/vyper/commit/0bb7203b584e771b23536ba065a6efda457161bb.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "vyper"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.3.8"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 0.3.7"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/vyperlang/vyper/security/advisories/GHSA-6m97-7527-mh74"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2023-46247"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/vyperlang/vyper/commit/0bb7203b584e771b23536ba065a6efda457161bb"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-307.yaml"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/vyperlang/vyper"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/vyperlang/vyper/blob/6020b8bbf66b062d299d87bc7e4eddc4c9d1c157/vyper/semantics/validation/data_positions.py#L197"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-193" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2023-12-13T13:18:52Z",
    "nvd_published_at" : "2023-12-13T20:15:49Z"
  }
}