CVE-2024-24564
published 2024-02-26CVE-2024-24564: Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. When using the built-in `extract32(b, start)`, if the `start` index provided has…
PriorityP425medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.56%
42.7th percentile
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. When using the built-in `extract32(b, start)`, if the `start` index provided has for side effect to update `b`, the byte array to extract `32` bytes from, it could be that some dirty memory is read and returned by `extract32`. This vulnerability is fixed in 0.4.0.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vyperlang | vyper | < 0.4.0 | 0.4.0 |
| vyperlang | vyper | >= 0 < 0.4.0 | 0.4.0 |
| vyperlang | vyper | >= 0 < 3d9c537142fb99b2672f21e2057f5f202cde194f | 3d9c537142fb99b2672f21e2057f5f202cde194f |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Vyper's `extract32` can ready dirty memory
osv·2024-02-26
CVE-2024-24564 [LOW] Vyper's `extract32` can ready dirty memory
Vyper's `extract32` can ready dirty memory
### Summary
When using the built-in `extract32(b, start)`, if the `start` index provided has for side effect to update `b`, the byte array to extract `32` bytes from, it could be that some dirty memory is read and returned by `extract32`.
As of v0.4.0 (specifically, commit https://github.com/vyperlang/vyper/commit/3d9c537142fb99b2672f21e2057f5f202cde194f), the compiler will panic instead of generating bytecode.
### Details
Before evaluating `start`, the function `Extract32.build_IR` caches only:
- The pointer in memory/storage to `b`: https://github.com/vyperlang/vyper/blob/10564dcc37756f3d3684b7a91fd8f4325a38c4d8/vyper/builtins/functions.py#L916-L918
- The length of `b`: https://github.com/vyperlang/vyper/blob/10564dcc37756f3d3684b7a91fd8f4
GHSA
Vyper's `extract32` can ready dirty memory
ghsa·2024-02-26
CVE-2024-24564 [LOW] CWE-125 Vyper's `extract32` can ready dirty memory
Vyper's `extract32` can ready dirty memory
### Summary
When using the built-in `extract32(b, start)`, if the `start` index provided has for side effect to update `b`, the byte array to extract `32` bytes from, it could be that some dirty memory is read and returned by `extract32`.
As of v0.4.0 (specifically, commit https://github.com/vyperlang/vyper/commit/3d9c537142fb99b2672f21e2057f5f202cde194f), the compiler will panic instead of generating bytecode.
### Details
Before evaluating `start`, the function `Extract32.build_IR` caches only:
- The pointer in memory/storage to `b`: https://github.com/vyperlang/vyper/blob/10564dcc37756f3d3684b7a91fd8f4325a38c4d8/vyper/builtins/functions.py#L916-L918
- The length of `b`: https://github.com/vyperlang/vyper/blob/10564dcc37756f3d3684b7a91fd8f4
OSV
CVE-2024-24564: Vyper is a pythonic Smart Contract Language for the ethereum virtual machine
osv·2024-02-26
CVE-2024-24564 CVE-2024-24564: Vyper is a pythonic Smart Contract Language for the ethereum virtual machine
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. When using the built-in `extract32(b, start)`, if the `start` index provided has for side effect to update `b`, the byte array to extract `32` bytes from, it could be that some dirty memory is read and returned by `extract32`. This vulnerability is fixed in 0.4.0.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-02-26
Published