PT-2023-23179 · Vyper · Vyper

Charles-Cooper + 1 · Published 2023-05-11 · Updated 2025-01-24 · CVE-2023-31146

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vyper versions prior to 0.3.8

Description The issue occurs during codegen when the length word of a dynarray is written before the data. This can result in out-of-bounds array access when the dynarray is on both the lhs and rhs of an assignment, potentially causing data corruption across call frames. The expected behavior is to revert due to out-of-bounds array access.

Recommendations For versions prior to 0.3.8, update to version 0.3.8 to resolve the issue. As a temporary workaround, consider avoiding assignments where a dynarray is on both the lhs and rhs to minimize the risk of exploitation. Restrict the use of dynarrays in critical functions until the issue is resolved.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2023-31146

GHSA-3P37-3636-Q8WV

PYSEC-2023-77

Affected Products

Vyper

References · 11

• 🔥 https://github.com/vyperlang/vyper/security/advisories/GHSA-3p37-3636-q8wv · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/31xxx/CVE-2023-31146.json · Exploit
• https://github.com/vyperlang/vyper/commit/4f8289a81206f767df1900ac48f485d90fc87edb · Patch
• https://osv.dev/vulnerability/GHSA-3p37-3636-q8wv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-31146 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-31146 · Security Note
• https://osv.dev/vulnerability/PYSEC-2023-77 · Vendor Advisory
• https://github.com/vyperlang/vyper · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-77.yaml · Note
• https://t.me/cvenotify/108503 · Telegram Post
• https://t.me/cibsecurity/63928 · Telegram Post