Executive brief
OpenZeppelin Contracts is a widely-used library for secure smart contract development. The Base64.encode function can read uninitialized memory beyond the input buffer when processing inputs that aren't multiples of 3 bytes, potentially leaking sensitive data or corrupting encoded output. An attacker could exploit this in scenarios where memory layout is predictable to extract or manipulate sensitive information.
Technical details
The vulnerability is a buffer over-read (CWE-125) in the Base64.encode function. When the input byte length is not a multiple of 3, the iteration logic reads up to 2 bytes beyond the allocated input buffer. Although the output is padded correctly, 4 bits of uninitialized ("dirty") memory are retained in the encoded data before padding, corrupting the base64 output if adjacent memory is non-zero. The attack vector is network (contracts deployed on-chain), requires no authentication or user interaction, and affects versions 4.5.0–5.0.1 of @openzeppelin/contracts and @openzeppelin/contracts-upgradeable. Patches are available in versions 4.9.6 and 5.0.2.
Affected products
- OpenZeppelin Contracts 4.5.0 to 5.0.1
- OpenZeppelin Contracts Upgradeable 4.5.0 to 5.0.1
Timeline
- 2024-02-29: disclosed: Advisory GHSA-9vx6-7xxf-x967 published
- 2024-02-29: patched: Patches released: versions 4.9.6 and 5.0.2