CVE-2025-70956

Executive Summary

CVE-2025-70956 is a critical state pollution vulnerability in the TON Virtual Machine (TVM) prior to version v2025.04. The flaw resides in the RUNVM instruction logic (VmState::run_child_vm), which initializes child virtual machines. During this process, critical resources (libraries and log) are moved from the parent state to the child state in a non-atomic manner. If an Out-of-Gas (OOG) exception occurs after the resources are moved but before the state transition is finalized, the parent VM retains a corrupted state where these resources are emptied or invalid. Because RUNVM supports gas isolation, the parent VM continues execution with this corrupted state, leading to unexpected behavior or denial of service within the contract's context.

This vulnerability is particularly dangerous in smart contract environments where gas limits are enforced, as an attacker can trigger an OOG condition to corrupt the parent VM state, potentially causing cascading failures across multiple contracts.

Supply Chain & Package Security

This vulnerability affects the TON blockchain ecosystem, specifically the TVM implementation. While not a traditional package manager vulnerability, the TVM is a core component of the TON blockchain, and any contract deployed on TON is potentially affected. Developers should ensure they are using TVM version v2025.04 or later.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (Unscored) CVSS Vector: UNKNOWN

Threat Level: High (based on technical analysis)

Rationale:

• Attack Vector (AV): Network (exploitable via contract interaction)
• Attack Complexity (AC): Low (requires triggering an OOG condition)
• Privileges Required (PR): None (any contract can trigger)
• User Interaction (UI): None
• Scope (S): Changed (parent VM state corruption affects other contracts)
• Confidentiality (C): None (no data leak)
• Integrity (I): High (state corruption)
• Availability (A): High (denial of service)

Deep Dive & Mechanics

The vulnerability is rooted in the non-atomic resource transfer during child VM initialization in VmState::run_child_vm. The process involves:

1. Resource Movement: Libraries and log data are moved from the parent VM state to the child VM state.
2. State Transition: The child VM begins execution.
3. OOG Exception: If the child VM runs out of gas during execution, an exception is thrown.
4. Corrupted State: The parent VM state is left with empty/invalid libraries and log references because the resources were moved but not rolled back.
5. Continued Execution: Due to gas isolation, the parent VM continues execution with the corrupted state.

This can lead to:

• Denial of Service: Contracts relying on libraries or log data may fail.
• Unexpected Behavior: Corrupted state can cause incorrect contract execution.
• Cascading Failures: Multiple contracts sharing the same parent VM may be affected.

Vulnerable vs. Patched Code

Vulnerable Code (TVM < v2025.04):

// Non-atomic resource transfer
void VmState::run_child_vm(ChildVmConfig& config) {
    // Move resources to child
    child_state.libraries = std::move(this->libraries);
    child_state.log = std::move(this->log);
    
    // Execute child VM
    child_state.execute(config);
    
    // If OOG occurs here, parent state is corrupted
    // No rollback mechanism
}

Patched Code (TVM >= v2025.04):

// Atomic resource transfer with rollback
void VmState::run_child_vm(ChildVmConfig& config) {
    // Save parent state
    auto saved_libraries = this->libraries;
    auto saved_log = this->log;
    
    // Move resources to child
    child_state.libraries = std::move(this->libraries);
    child_state.log = std::move(this->log);
    
    try {
        // Execute child VM
        child_state.execute(config);
    } catch (const OutOfGasException&) {
        // Rollback on OOG
        this->libraries = std::move(saved_libraries);
        this->log = std::move(saved_log);
        throw;
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a TON blockchain node running TVM < v2025.04
• Ability to deploy and execute smart contracts

Exploitation Steps:

1. Deploy a malicious contract that triggers an OOG condition in a child VM.
2. Craft the child VM call to consume all available gas after resource transfer.
3. Observe parent VM state corruption after the OOG exception.
4. Leverage corrupted state to cause denial of service or unexpected behavior in other contracts.

Example Contract (Conceptual):

contract Exploit {
    function triggerOOG() public {
        // Create child VM with minimal gas
        // After resource transfer, consume all gas
        while (true) {
            // Infinite loop to trigger OOG
        }
    }
}

Blue Team

Detection:

• Monitor for contracts that frequently trigger OOG exceptions in child VMs.
• Look for anomalies in library and log state across contract executions.
• Use gas profiling to identify contracts consuming excessive gas in child VMs.

Prevention:

• Update TVM to v2025.04 or later.
• Implement gas limits on child VM executions.
• Use atomic operations for resource transfers.

Indicators of Compromise (IOCs)

• Contract Addresses: Contracts that repeatedly trigger OOG in child VMs.
• Transaction Hashes: Transactions with failed child VM executions followed by parent VM state corruption.
• Log Patterns: Missing or corrupted log entries in contract execution traces.
• Library References: Empty or invalid library references in parent VM state.

Detection Engineering

YARA Rule

rule CVE_2025_70956_TVM_State_Pollution {
    meta:
        description = "Detects TON TVM state pollution vulnerability"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-70956"
    strings:
        $s1 = "run_child_vm" ascii wide
        $s2 = "libraries" ascii wide
        $s3 = "std::move" ascii wide
        $s4 = "OutOfGas" ascii wide
    condition:
        all of ($s1, $s2, $s3, $s4)
}

Sigma Rule

title: CVE-2025-70956 TON TVM State Pollution
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects TON TVM state pollution vulnerability exploitation
author: Valters IT
date: 2025-04-01
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-70956
logsource:
    category: blockchain
    product: ton
detection:
    selection:
        event: "child_vm_oog"
        parent_state_corrupted: true
    condition: selection
falsepositives:
    - Legitimate OOG conditions without state corruption
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-70956 TON TVM State Pollution"; flow:to_server; content:"|72 75 6e 5f 63 68 69 6c 64 5f 76 6d|"; nocase; content:"|4f 75 74 4f 66 47 61 73|"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update TVM to version v2025.04 or later.
2. Monitor contracts for unusual OOG patterns.
3. Implement gas limits on child VM executions.

Long-term Fixes:

• Atomic operations for resource transfers in TVM.
• Rollback mechanisms for failed child VM executions.
• State validation after child VM completion.

Workarounds:

• Disable RUNVM if not required.
• Use gas isolation with strict limits.
• Audit contracts for dependency on child VM state.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert
This report is generated for educational and defensive purposes only.