CVE-2024-27094: OpenZeppelin Contracts base64 encoding reads from dirty memory

CVE-2024-27094 · Severity: low · CVSS 3.1 · Published 2024-02-29

OpenZeppelin Contracts is a widely-used library for secure smart contract development. The Base64.encode function can read uninitialized memory beyond the input buffer when processing inputs that aren't multiples of 3 bytes, potentially leaking sensitive data or corrupting encoded output. An attacker could exploit this in scenarios where memory layout is predictable to extract or manipulate sensitive information.

Technologies: OpenZeppelin Contracts, OpenZeppelin Contracts Upgradeable. Vendors: OpenZeppelin.

Quick answers

Is CVE-2024-27094 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-27094 being exploited in the wild.
How severe is CVE-2024-27094?
Low severity, with a CVSS score of 3.1, published 29 February 2024.
Which products and versions are affected?
OpenZeppelin Contracts 4.5.0 to 5.0.1; OpenZeppelin Contracts Upgradeable 4.5.0 to 5.0.1.
Is there a fix for CVE-2024-27094?
A patch was published on 2024-02-29: Patches released: versions 4.9.6 and 5.0.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-27094 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2024-27094?
Check whether you run OpenZeppelin Contracts or OpenZeppelin Contracts Upgradeable at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a buffer over-read (CWE-125) in the Base64.encode function. When the input byte length is not a multiple of 3, the iteration logic reads up to 2 bytes beyond the allocated input buffer. Although the output is padded correctly, 4 bits of uninitialized ("dirty") memory are retained in the encoded data before padding, corrupting the base64 output if adjacent memory is non-zero. The attack vector is network (contracts deployed on-chain), requires no authentication or user interaction, and affects versions 4.5.0–5.0.1 of @openzeppelin/contracts and @openzeppelin/contracts-upgradeable. Patches are available in versions 4.9.6 and 5.0.2.

Affected products

  • OpenZeppelin Contracts 4.5.0 to 5.0.1
  • OpenZeppelin Contracts Upgradeable 4.5.0 to 5.0.1

Identifiers

  • CVE-2024-27094
  • GHSA-9vx6-7xxf-x967

Timeline

  • 2024-02-29: disclosed: Advisory GHSA-9vx6-7xxf-x967 published
  • 2024-02-29: patched: Patches released: versions 4.9.6 and 5.0.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.