CVE-2023-34449

CVSS V2 None CVSS V3 None
Description
ink! is an embedded domain specific language to write smart contracts in Rust for blockchains built on the Substrate framework. Starting in version 4.0.0 and prior to version 4.2.1, the return value when using delegate call mechanics, either through `CallBuilder::delegate` or `ink_env::invoke_contract_delegate`, is decoded incorrectly. This bug was related to the mechanics around decoding a call's return buffer, which was changed as part of pull request 1450. Since this feature was only released in ink! 4.0.0, no previous versions are affected. Users who have an ink! 4.x series contract should upgrade to 4.2.1 to receive a patch.
Overview
  • CVE ID
  • CVE-2023-34449
  • Assigner
  • GitHub_M
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2023-06-14T20:10:54.842Z
  • Last Modified Date
  • 2023-06-14T20:11:15.570Z
Weakness Enumerations
CWE URL
CWE-754 http://cwe.mitre.org/data/definitions/754.html
CWE-253 http://cwe.mitre.org/data/definitions/253.html
References
Reference URL Reference Tags
https://github.com/paritytech/ink/security/advisories/GHSA-853p-5678-hv8f x_refsource_CONFIRM
https://github.com/paritytech/ink/pull/1450 x_refsource_MISC
https://github.com/paritytech/ink/commit/f1407ee9f87e5f64d467a22d26ee88f61db7f3db x_refsource_MISC
https://docs.rs/ink_env/4.2.0/ink_env/call/struct.CallBuilder.html#method.delegate x_refsource_MISC
https://docs.rs/ink_env/4.2.0/ink_env/fn.invoke_contract_delegate.html x_refsource_MISC
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2023-34449
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-34449
History
Created Old Value New Value Data Type Notes
2024-06-25 20:42:19 Added to TrackCVE