PT-2024-20454 · Vyper · Vyper
Ifrostizz
·
Published
2024-02-07
·
Updated
2024-02-15
·
CVE-2024-24563
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Vyper versions prior to the fixed version
Description
The issue arises from the typechecker allowing the usage of signed integers as indexes to arrays, which are defined for unsigned integers only. This can lead to unpredictable behavior, accessing inaccessible elements, and denial of service. The vulnerability is present in different forms in all versions. For signed integers, the 2's complement representation is used, and because the array was declared very large, the bounds checking will pass, with negative values being represented as very large numbers. There are three potential vulnerability classes: unpredictable behavior, accessing inaccessible elements, and denial of service. A contract search was performed, and no production contracts were found to be impacted.
Recommendations
As a temporary workaround, consider disabling the usage of signed integers as indexes to arrays until a patch is available.
Restrict access to large arrays to minimize the risk of exploitation.
Avoid using negative indexes in array accesses until the issue is resolved.
Update to a version that includes the patch for this issue, as mentioned in the GitHub pull request.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Improper Validation of Array Index
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Vyper