Junglewise Threat Intelligence

CVE-2018-18920: Ethereum Py-EVM arbitrary bytecode injection in vm.execute_bytecode

CVE-2018-18920 · Severity: high · CVSS 8.8 · Published 2018-11-21

Vendors: PyPI.

Executive brief

Py-EVM is a Python implementation of the Ethereum Virtual Machine used for executing smart contracts. A vulnerability in the way it handles bytecode execution allows attackers to inject arbitrary code or trigger execution failures. This could lead to smart contracts being executed indefinitely without paying the required gas fees, potentially causing service disruptions or financial imbalances in applications relying on this library.

Technical details

Py-EVM v0.2.0-alpha.33 is vulnerable to arbitrary bytecode injection via the vm.execute_bytecode call. The vulnerability arises when computation._stack.values is triggered with unexpected integer values (e.g., [100, 100, 0]) instead of the expected byte strings, leading to execution failures or invalid opcodes. This flaw is linked to a mechanism where smart contracts can be executed indefinitely without gas being consumed. The issue is categorized under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). While the CVSS vector suggests some user interaction (UI:R), the attack vector is network-based and can result in high impacts on confidentiality, integrity, and availability.

Affected products

  • Ethereum Foundation py-evm <= 0.2.0-alpha.33

Timeline

  • 2018-11-01: disclosed: Issue first reported on GitHub repository
  • 2018-11-11: advisory: NVD published CVE-2018-18920
  • 2018-11-21: advisory: GitHub Advisory published

References