CVE-2023-42443: Vyper vulnerable to memory corruption in certain builtins utilizing `msize`

(updated )

In certain conditions, the memory used by the builtins raw_call, create_from_blueprint and create_copy_of can be corrupted.

  • For raw_call, the argument buffer of the call can be corrupted, leading to incorrect calldata in the sub-context.
  • For create_from_blueprint and create_copy_of, the buffer for the to-be-deployed bytecode can be corrupted, leading to deploying incorrect bytecode.

Below are the conditions that must be fulfilled for the corruption to happen for each builtin:

References

Code Behaviors & Features

Detect and mitigate CVE-2023-42443 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →