Vulnerability · Published Feb 26, 2024 · Assigned by GitHub_M

CVE-2024-24564Vyper extract32 can ready dirty memory

Low 3.7

In plain English

A low-severity out-of-bounds read in vyper from vyperlang. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.6%top 52.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. When using the built-in `extract32(b, start)`, if the `start` index provided has for side effect to update `b`, the byte array to extract `32` bytes from, it could be that some dirty memory is read and returned by `extract32`. This vulnerability is fixed in 0.4.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	vyper	0.4.0	GHSA-4hwq-4cpm-8vmx
PyPI	vyper	0.4.0	PYSEC-2024-205

Affected products (as reported)

Vendor	Product	Versions
vyperlang	vyper	< 0.4.0

Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/vyperlang/vyper/security/advisories/GHSA-4hwq-4cpm-8vmx x_refsource_CONFIRM
https://github.com/vyperlang/vyper/commit/3d9c537142fb99b2672f21e2057f5f202cde194f x_refsource_MISC