Listen to this Post
The CVE describes a critical memory isolation failure within the Fuel Virtual Machine (FuelVM). The vulnerability stems from improper memory deallocation. When a smart contract executes the `ret` opcode to return from a function and deallocate a memory region, the VM fails to clear or securely invalidate that memory. The physical memory pages are simply returned to the available pool without being zeroed out. Subsequently, when a different, potentially untrusted, smart contract is executed and performs a memory load operation (mload) on a newly allocated memory region that overlaps the previously deallocated one, it can read the stale, residual data. This data could include sensitive information like private keys or application state from the previously executed contract, fundamentally breaking the security boundary and isolation guarantee between contracts on the chain.
Platform: FuelVM
Version: < v0.60.1
Vulnerability: Memory Isolation Bypass
Severity: Critical
date: 2025-04-18
Prediction: Patched 2025-04-18
What Undercode Say:
Simulating the vulnerable memory access pattern $ fuelvm run contract_a Leaves "sensitive_data" in memory $ fuelvm run contract_b contract_b mloads from same memory region, reads "sensitive_data"
// Pseudocode illustrating the flaw
fn vulnerable_contract() {
let secret = mload(0x40);
// ... use secret ...
ret; // Memory at 0x40 is deallocated but not cleared
}
fn attacker_contract() {
// This mload may read the 'secret' from vulnerable_contract's old memory
let leaked_data = mload(0x40);
}
How Exploit:
Malicious contract performs `mload` operations on freshly allocated memory to harvest residual data from previous contract executions, potentially extracting sensitive keys or state.
Protection from this CVE:
Upgrade FuelVM to version v0.60.1 or v0.59.3. The patch ensures memory is zeroed upon deallocation via the `ret` opcode, preventing data leakage.
Impact:
Complete breach of inter-contract memory isolation, allowing unauthorized reading of sensitive data from other contracts, compromising fundamental blockchain security.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
