PT-2024-19409 · Vyper · Vyper
Cyberthirst
+1
·
Published
2024-01-18
·
Updated
2024-10-09
·
CVE-2024-22419
CVSS v3.1
7.3
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
Vyper versions 0.3.0 through 0.3.9
Description
The
concat built-in can write over the bounds of the memory buffer that was allocated for it and thus overwrite existing valid data. The root cause is that the build IR for concat doesn't properly adhere to the API of copy functions. A contract search was performed and no vulnerable contracts were found in production. The buffer overflow can result in the change of semantics of the contract. The overflow is length-dependent and thus it might go unnoticed during contract testing. However, certainly not all usages of concat will result in overwritten valid data as we require it to be in an internal function and close to the return statement where other memory allocations don't occur.Recommendations
For versions 0.3.0 through 0.3.9, update to version 0.4.0 to resolve the issue.
As a temporary workaround, consider avoiding the use of the
concat function in internal functions close to the return statement where other memory allocations don't occur.
Restrict access to the vulnerable concat function to minimize the risk of exploitation.Exploit
Fix
Memory Corruption
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Vyper