Bug 2557986 (CVE-2021-48018)
| Summary: | CVE-2021-48018 vyper: Vyper: Contract state corruption via overlapping reentrancy lock allocation | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Vyper. The compiler improperly assigns storage locations for reentrancy locks—safeguards designed to prevent repeated, recursive execution—to the same memory slots as contract variables. When an external caller invokes a protected function, setting the lock overwrites existing contract data, resulting in storage corruption and disruption of the contract's intended logic.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2565621 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-10-21 00:57:39 UTC
|