PT-2024-21300 · Vyper · Vyper

Minaminao-Osec · Published 2024-02-26 · Updated 2025-01-16 · CVE-2024-26149

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Vyper versions 0.3.10 and earlier

Description The issue arises when an excessively large value is specified as the starting index for an array in abi decode, causing the read position to overflow. This results in the decoding of values outside the intended array bounds, potentially leading to exploitations in contracts that use arrays within abi decode.

Recommendations For versions 0.3.10 and earlier, update to a version that includes the patches from https://github.com/vyperlang/vyper/pull/3925, https://github.com/vyperlang/vyper/pull/4091, https://github.com/vyperlang/vyper/pull/4144, or https://github.com/vyperlang/vyper/pull/4060 to resolve the issue. As a temporary workaround, consider restricting the use of the abi decode function with large starting indices for arrays to minimize the risk of exploitation.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-120

Related Identifiers

CVE-2024-26149

GHSA-9P8R-4XP4-GW5W

PYSEC-2024-164

Affected Products

Vyper

References · 15

• 🔥 https://github.com/vyperlang/vyper/security/advisories/GHSA-9p8r-4xp4-gw5w · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26149.json · Exploit
• https://osv.dev/vulnerability/GHSA-9p8r-4xp4-gw5w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-26149 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-26149 · Security Note
• https://osv.dev/vulnerability/PYSEC-2024-164 · Vendor Advisory
• https://github.com/vyperlang/vyper · Note
• https://github.com/vyperlang/vyper/pull/4060 · Note
• https://github.com/vyperlang/vyper/pull/3925 · Note
• https://github.com/vyperlang/vyper/pull/4091 · Note
• https://github.com/vyperlang/vyper/pull/4144 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2024-164.yaml · Note
• https://twitter.com/VulmonFeeds/status/1762229013865550053 · Twitter Post
• https://twitter.com/CVEnew/status/1762213071160844634 · Twitter Post
• https://t.me/cvenotify/107677 · Telegram Post