PT-2024-20449 · Vyper · Vyper

Kuroi8 · Published 2024-02-05 · Updated 2024-02-12 · CVE-2024-24559

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Vyper versions v0.2.0 through v0.3.10

Description There is an error in the stack management when compiling the IR for sha3 64. Concretely, the height variable is miscalculated. The vulnerability can't be triggered without writing the IR by hand, meaning it cannot be triggered from regular Vyper code. sha3 64 is used for retrieval in mappings. No flow that would cache the key was found, so the issue shouldn't be possible to trigger when compiling the compiler-generated IR. This issue isn't triggered during normal compilation of Vyper code, so the impact is low.

Recommendations For Vyper versions v0.2.0 through v0.3.10, update to a version that includes the patch from https://github.com/vyperlang/vyper/pull/4063 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2024-24559

GHSA-6845-XW22-FFXV

PYSEC-2024-147

Affected Products

Vyper

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24559.json · Exploit
• https://github.com/vyperlang/vyper/security/advisories/GHSA-6845-xw22-ffxv · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6845-xw22-ffxv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-24559 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-24559 · Security Note
• https://osv.dev/vulnerability/PYSEC-2024-147 · Vendor Advisory
• https://github.com/vyperlang/vyper/blob/c150fc49ee9375a930d177044559b83cb95f7963/vyper/ir/compile_ir.py#L585-L586 · Note
• https://github.com/vyperlang/vyper · Note
• https://github.com/vyperlang/vyper/commit/d9f9fdadd81a148cbc68f02dbbbcdc0c92fad652 · Note
• https://github.com/vyperlang/vyper/pull/4063 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2024-147.yaml · Note
• https://twitter.com/CVEnew/status/1754614418711761333 · Twitter Post
• https://t.me/cvenotify/71142 · Telegram Post