CVE-2023-39363: Vyper incorrectly allocated named re-entrancy locks
First published: Mon Aug 07 2023(Updated: )
### Impact In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in contracts compiled with the susceptible versions. A specific set of conditions is required to result in misbehavior of affected contracts, specifically: - A `.vy` contract compiled with either of the following `vyper` versions: `0.2.15`, `0.2.16`, `0.3.0` - A primary function that utilizes the `@nonreentrant` decorator with a specific `key` and does not strictly follow the check-effects-interaction pattern (i.e. contains an external call to an untrusted party before storage updates) - A secondary function that utilizes the same `key` and would be affected by the improper state caused by the primary function ### Patches https://github.com/vyperlang/vyper/pull/2439, https://github.com/vyperlang/vyper/pull/2514 ### Workarounds Upgrade to 0.3.1 or higher ### References Technical post-mortem report: https://hackmd.io/@vyperlang/HJUgNMhs2
Credit: security-advisories@github.com security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Vyperlang Vyper | =0.2.15 | |
| Vyperlang Vyper | =0.2.16 | |
| Vyperlang Vyper | =0.3.0 | |
| pip/vyper | >=0.2.15<0.3.1 | 0.3.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/vyperlang/vyper/security/advisories/GHSA-5824-cm3x-3c38
- https://nvd.nist.gov/vuln/detail/CVE-2023-39363
- https://github.com/vyperlang/vyper/pull/2439
- https://github.com/vyperlang/vyper/pull/2514
- https://hackmd.io/@LlamaRisk/BJzSKHNjn
- https://hackmd.io/@vyperlang/HJUgNMhs2
- https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-142.yaml
- https://github.com/advisories/GHSA-5824-cm3x-3c38 (Advisory)
Frequently Asked Questions
What is CVE-2023-39363?
CVE-2023-39363 is a vulnerability in Vyper, a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM).
What is the impact of CVE-2023-39363?
CVE-2023-39363 allows for cross-function re-entrancy in contracts compiled with susceptible versions of Vyper, specifically 0.2.15, 0.2.16, and 0.3.0.
How can I fix CVE-2023-39363?
To fix CVE-2023-39363, update Vyper to version 0.3.1 or higher.
How severe is CVE-2023-39363?
CVE-2023-39363 has a severity value of 5.9, which is considered medium.
Where can I find more information about CVE-2023-39363?
You can find more information about CVE-2023-39363 on the GitHub pull requests [2439](https://github.com/vyperlang/vyper/pull/2439) and [2514](https://github.com/vyperlang/vyper/pull/2514), as well as the [security advisory](https://github.com/vyperlang/vyper/security/advisories/GHSA-5824-cm3x-3c38).
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/references
- agent/weakness
- agent/title
- agent/author
- agent/remedy
- agent/description
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-5824-cm3x-3c38
- alias/CVE-2023-39363
- collector/nvd-cve
- collector/mitre-cve
- source/MITRE
- agent/event
- collector/github-advisory
- agent/severity
- agent/tags
- agent/trending
- vendor/vyperlang
- canonical/vyperlang vyper
- version/vyperlang vyper/0.2.15
- version/vyperlang vyper/0.2.16
- version/vyperlang vyper/0.3.0
- package-manager/pip