CVE-2023-30837
published 2023-05-08CVE-2023-30837: Vyper is a pythonic smart contract language for the EVM. The storage allocator does not guard against allocation overflows in versions prior to 0.3.8. An…
PriorityP339high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
0.70%
48.9th percentile
Vyper is a pythonic smart contract language for the EVM. The storage allocator does not guard against allocation overflows in versions prior to 0.3.8. An attacker can overwrite the owner variable. This issue was fixed in version 0.3.8.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vyperlang | vyper | < 0.3.8 | 0.3.8 |
| vyperlang | vyper | >= 0 < 0.3.8 | 0.3.8 |
| vyperlang | vyper | >= 0 < 0bb7203b584e771b23536ba065a6efda457161bb | 0bb7203b584e771b23536ba065a6efda457161bb |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2023-30837: Vyper is a pythonic smart contract language for the EVM
osv·2023-05-08
CVE-2023-30837 CVE-2023-30837: Vyper is a pythonic smart contract language for the EVM
Vyper is a pythonic smart contract language for the EVM. The storage allocator does not guard against allocation overflows in versions prior to 0.3.8. An attacker can overwrite the owner variable. This issue was fixed in version 0.3.8.
OSV
vyper vulnerable to storage allocator overflow
osv·2023-05-05
CVE-2023-30837 [HIGH] vyper vulnerable to storage allocator overflow
vyper vulnerable to storage allocator overflow
### Impact
The storage allocator does not guard against allocation overflows. This can result in vulnerabilities like the following:
```vyper
owner: public(address)
take_up_some_space: public(uint256[10])
buffer: public(uint256[max_value(uint256)])
@external
def initialize():
self.owner = msg.sender
@external
def foo(idx: uint256, data: uint256):
self.buffer[idx] = data
```
Per @toonvanhove, "An attacker can overwrite the owner variable by calling this contract with calldata: `0x04bc52f8 fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff5 ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff` (spaces inserted for readability)
`0x04bc52f8` is the selector for `foo(uint256, uint256)`, and the last argument `fff...fff`
GHSA
vyper vulnerable to storage allocator overflow
ghsa·2023-05-05
CVE-2023-30837 [HIGH] CWE-789 vyper vulnerable to storage allocator overflow
vyper vulnerable to storage allocator overflow
### Impact
The storage allocator does not guard against allocation overflows. This can result in vulnerabilities like the following:
```vyper
owner: public(address)
take_up_some_space: public(uint256[10])
buffer: public(uint256[max_value(uint256)])
@external
def initialize():
self.owner = msg.sender
@external
def foo(idx: uint256, data: uint256):
self.buffer[idx] = data
```
Per @toonvanhove, "An attacker can overwrite the owner variable by calling this contract with calldata: `0x04bc52f8 fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff5 ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff` (spaces inserted for readability)
`0x04bc52f8` is the selector for `foo(uint256, uint256)`, and the last argument `fff...fff`
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/vyperlang/vyper/commit/0bb7203b584e771b23536ba065a6efda457161bbhttps://github.com/vyperlang/vyper/security/advisories/GHSA-mgv8-gggw-mrg6https://github.com/vyperlang/vyper/commit/0bb7203b584e771b23536ba065a6efda457161bbhttps://github.com/vyperlang/vyper/security/advisories/GHSA-mgv8-gggw-mrg6
2023-05-08
Published