PT-2024-24738 · Vyper · Vyper

Chen-Robert · Published 2024-04-25 · Updated 2025-01-02 · CVE-2024-32645

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Vyper versions 0.3.10 and prior

Description The issue arises when the raw log builtin is called with memory or storage arguments to be used as topics, resulting in incorrect values being logged. This is due to the build IR function of the RawLog class failing to properly unwrap the variables provided as topics. A contract search was performed and no vulnerable contracts were found in production. The estimated number of potentially affected devices is not available. There is no information about real-world incidents where this issue was exploited.

Recommendations For Vyper versions 0.3.10 and prior, update to a version that includes the fix from https://github.com/vyperlang/vyper/pull/3977. As a temporary workaround, consider avoiding the use of the raw log builtin with memory or storage arguments until a patch is available. Restrict access to the build IR function of the RawLog class to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2024-32645

GHSA-XCHQ-W5R3-4WG3

PYSEC-2024-206

Affected Products

Vyper

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32645.json · Exploit
• https://github.com/vyperlang/vyper/security/advisories/GHSA-xchq-w5r3-4wg3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-32645 · Security Note
• https://osv.dev/vulnerability/GHSA-xchq-w5r3-4wg3 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-206 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-32645 · Vendor Advisory
• https://github.com/vyperlang/vyper · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2024-206.yaml · Note
• https://t.me/cvenotify/78150 · Telegram Post