PT-2024-24739 · Vyper · Vyper

Cyberthirst · Published 2024-04-25 · Updated 2025-01-02 · CVE-2024-32646

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Vyper versions 0.3.10 and prior

Description Using the slice builtin can result in a double eval vulnerability when the buffer argument is either msg.data, self.code or <address>.code and either the start or length arguments have side-effects. The impact is low, and no vulnerable production contracts were found. Double evaluation of side-effects should be easily discoverable in client tests.

Recommendations As a temporary workaround, consider avoiding the use of the slice builtin with msg.data, self.code, or <address>.code as the buffer argument, especially when the start or length arguments have side-effects, until a fixed version is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2024-32646

GHSA-R56X-J438-VW5M

PYSEC-2024-207

Affected Products

Vyper

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32646.json · Exploit
• https://github.com/vyperlang/vyper/security/advisories/GHSA-r56x-j438-vw5m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-32646 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r56x-j438-vw5m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-32646 · Security Note
• https://osv.dev/vulnerability/PYSEC-2024-207 · Vendor Advisory
• https://github.com/vyperlang/vyper · Note
• https://github.com/vyperlang/vyper/pull/2914 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2024-207.yaml · Note