PT-2023-27764 · Vyper · Vyper

Charles-Cooper + 1 · Published 2023-09-04 · Updated 2023-09-08 · CVE-2023-41052

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Vyper (affected versions not specified)

Description The order of evaluation of the arguments of the builtin functions uint256 addmod, uint256 mulmod, ecadd, and ecmul does not follow source order. This behavior is problematic when the evaluation of one of the arguments produces side effects that other arguments depend on. For uint256 addmod(a,b,c) and uint256 mulmod(a,b,c), the order is c,a,b. For ecadd(a,b) and ecmul(a,b), the order is b,a.

Recommendations As a temporary workaround, consider ensuring that the arguments of the expression do not produce side effects or, if one does, that no other argument is dependent on those side effects when using builtins from the list above. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-670

Related Identifiers

CVE-2023-41052

GHSA-4HG4-9MF5-WXXQ

PYSEC-2023-168

Affected Products

Vyper

References · 12

• 🔥 https://github.com/vyperlang/vyper/security/advisories/GHSA-4hg4-9mf5-wxxq · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41052.json · Exploit
• https://github.com/vyperlang/vyper/pull/3583 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-41052 · Security Note
• https://osv.dev/vulnerability/CVE-2023-41052 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4hg4-9mf5-wxxq · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-168 · Vendor Advisory
• https://github.com/vyperlang/vyper · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-168.yaml · Note
• https://t.me/cibsecurity/69805 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1698797759166292103 · Twitter Post
• https://twitter.com/CVEnew/status/1698756209971753195 · Twitter Post