GHSA-f5x6-7qgp-jhf3: ecrecover can return undefined data if signature does not verify

Skip to content

• • Actions

    Automate any workflow

  • Packages

    Host and manage packages

  • Security

    Find and fix vulnerabilities

  • Codespaces

    Instant dev environments

  • Copilot

    Write better code with AI

  • Code review

    Manage code changes

  • Issues

    Plan and track work

  • Discussions

    Collaborate outside of code

• • GitHub Sponsors

    Fund open source developers

*   The ReadME Project
    
    GitHub community articles

• Pricing

1. GitHub Advisory Database
2. GitHub Reviewed
3. CVE-2023-37902

ecrecover can return undefined data if signature does not verify

Moderate severity GitHub Reviewed Published Jul 25, 2023 in vyperlang/vyper • Updated Jul 25, 2023

Affected versions

< 0.3.10

Description

Impact

the ecrecover precompile does not fill the output buffer if the signature does not verify, see https://github.com/ethereum/go-ethereum/blob/b058cf454b3bdc7e770e2b3cec83a0bcb48f55ee/core/vm/contracts.go#L188. however, the ecrecover builtin will still return whatever is at memory location 0.

this means that the if the compiler has been convinced to write to the 0 memory location with specially crafted data (generally, this can happen with a hashmap access or immutable read) just before the ecrecover, a signature check might pass on an invalid signature.

Patches

v0.3.10

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

References

Are there any links users can visit to find out more?

References

• GHSA-f5x6-7qgp-jhf3
• vyperlang/vyper@019a37a

Published to the GitHub Advisory Database

Jul 25, 2023

Last updated

Jul 25, 2023