CVE-2023-42460: _abi_decode input not validated in complex expressions in Vyper
Impact abidecode() does not validate input when it is nested in an expression. the following example gets correctly validated (bounds checked): vyper x: int128 = abidecode(slice(msg.data, 4, 32), int128)
however, the following example is not bounds checked vyper @external def abidecode(x: uint256) -> uint256: a: uint256 = convert(abidecode(slice(msg.data, 4, 32), (uint8)), uint256) + 1 return a # abidecode(256) returns: 257
the issue can be triggered by constructing an example where the output of abidecode is not internally passed to makesetter (an internal codegen routine) or other input validating routine.
Patches https://github.com/vyperlang/vyper/pull/3626
Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading?
References Are there any links users can visit to find out more?
Other sources
Vyper is a Pythonic Smart Contract Language for the EVM. The abidecode() function does not validate input when it is nested in an expression. Uses of abidecode() can be constructed which allow for bounds checking to be bypassed resulting in incorrect results. This issue has not yet been fixed, but a fix is expected in release 0.3.10. Users are advised to reference pull request #3626.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the impact of CVE-2023-42460?
`_abi_decode()` does not validate input when it is nested in an expression, allowing potential security vulnerabilities.
Which software is affected by CVE-2023-42460?
Vyper versions between 0.3.4 and 0.3.10 are affected.
How can I fix CVE-2023-42460?
Update the Vyper package to version 0.3.10 or apply the appropriate remedy.
Where can I find more information about CVE-2023-42460?
You can find more information about CVE-2023-42460 on the GitHub security advisory page: [link](https://github.com/vyperlang/vyper/security/advisories/GHSA-cx2q-hfxr-rj97).