PT-2024-24605 · Vyper · Vyper

Trocher · Published 2024-04-25 · Updated 2024-04-25 · CVE-2024-32481

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Vyper versions 0.3.8 through 0.4.0b1

Description The issue arises when looping over a range of the form range(start, start + N), where start is a signed integer and can be negative. This causes the execution to always revert due to an incorrect assertion inserted by the code generation of the range statement. The problem occurs because start is interpreted as an unsigned integer for comparison, and if it is negative, its 255th bit is set to 1, making it a very large unsigned integer and causing the assertion to fail. Any contract with a range(start, start + N) where start is a signed integer and can be negative is affected.

Recommendations For versions 0.3.8 through 0.4.0b1, update to version 0.4.0b1 or later, which fixes the issue by disallowing the problematic form of range(). As a temporary workaround, consider avoiding the use of range(start, start + N) with negative start values in affected contracts until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-681

Related Identifiers

CVE-2024-32481

GHSA-PPX5-Q359-PVWJ

PYSEC-2024-246

Affected Products

Vyper

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32481.json · Exploit
• https://github.com/vyperlang/vyper/commit/3de1415ee77a9244eb04bdb695e249d3ec9ed868 · Patch
• https://github.com/vyperlang/vyper/commit/5319cfbe14951e007ccdb323257e5ada869b35d5 · Patch
• https://github.com/vyperlang/vyper/security/advisories/GHSA-ppx5-q359-pvwj · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-246 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-32481 · Security Note
• https://osv.dev/vulnerability/GHSA-ppx5-q359-pvwj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-32481 · Vendor Advisory
• https://github.com/vyperlang/vyper · Note
• https://github.com/vyperlang/vyper/blob/9136169468f317a53b4e7448389aa315f90b95ba/vyper/codegen/stmt.py#L286-L287 · Note