PT-2024-20455 · Vyper · Vyper

Trocher · Published 2024-02-26 · Updated 2025-01-16 · CVE-2024-24564

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Vyper versions prior to 0.4.0

Description The issue arises when using the built-in extract32(b, start) function in Vyper, a pythonic Smart Contract Language for the Ethereum virtual machine. If the start index provided has a side effect that updates b, the byte array, it could lead to reading and returning dirty memory.

Recommendations For versions prior to 0.4.0, update to version 0.4.0 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the extract32(b, start) function when the start index has a side effect that updates b. Restrict access to the extract32 function to minimize the risk of exploitation.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2024-24564

GHSA-4HWQ-4CPM-8VMX

PYSEC-2024-205

Affected Products

Vyper

References · 14

• 🔥 https://github.com/vyperlang/vyper/security/advisories/GHSA-4hwq-4cpm-8vmx · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24564.json · Exploit
• https://github.com/vyperlang/vyper/commit/3d9c537142fb99b2672f21e2057f5f202cde194f · Patch
• https://osv.dev/vulnerability/PYSEC-2024-205 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-24564 · Security Note
• https://osv.dev/vulnerability/GHSA-4hwq-4cpm-8vmx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-24564 · Vendor Advisory
• https://github.com/vyperlang/vyper · Note
• https://github.com/vyperlang/vyper/blob/10564dcc37756f3d3684b7a91fd8f4325a38c4d8/vyper/builtins/functions.py#L920-L922 · Note
• https://github.com/vyperlang/vyper/blob/10564dcc37756f3d3684b7a91fd8f4325a38c4d8/vyper/builtins/functions.py#L916-L918 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2024-205.yaml · Note
• https://t.me/cvenotify/107676 · Telegram Post
• https://twitter.com/CVEnew/status/1762213070145818878 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1762229267071389757 · Twitter Post