CVE-2024-24564

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-24564
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. When using the built-in `extract32(b, start)`, if the `start` index provided has for side effect to update `b`, the byte array to extract `32` bytes from, it could be that some dirty memory is read and returned by `extract32`. This vulnerability is fixed in 0.4.0.

3.7 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/vyperlang/vyper/commit/3d9c537142fb99b2672f21e2057f5f202cde194f Patch
https://github.com/vyperlang/vyper/security/advisories/GHSA-4hwq-4cpm-8vmx Exploit Vendor Advisory
https://github.com/vyperlang/vyper/security/advisories/GHSA-4hwq-4cpm-8vmx Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:python:*:*
History

16 Jan 2025, 19:34

Type Values Removed Values Added
First Time Vyperlang vyper
Vyperlang
References () https://github.com/vyperlang/vyper/commit/3d9c537142fb99b2672f21e2057f5f202cde194f - () https://github.com/vyperlang/vyper/commit/3d9c537142fb99b2672f21e2057f5f202cde194f - Patch
References () https://github.com/vyperlang/vyper/security/advisories/GHSA-4hwq-4cpm-8vmx - () https://github.com/vyperlang/vyper/security/advisories/GHSA-4hwq-4cpm-8vmx - Exploit, Vendor Advisory
CPE cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:python:*:*

21 Nov 2024, 08:59

Type Values Removed Values Added
References () https://github.com/vyperlang/vyper/security/advisories/GHSA-4hwq-4cpm-8vmx - () https://github.com/vyperlang/vyper/security/advisories/GHSA-4hwq-4cpm-8vmx -

09 Oct 2024, 20:15

Type Values Removed Values Added
Summary
  • (es) Vyper es un lenguaje de contrato inteligente pitónico para la máquina virtual ethereum. Cuando se utiliza el `extract32(b, start)` integrado, si el índice `start` proporcionado tiene como efecto secundario actualizar `b`, la matriz de bytes de la que extraer `32` bytes, podría ser que "extract32" lea y devuelva algo de memoria sucia. Esta vulnerabilidad afecta a la versión 0.3.10 y versiones anteriores.
Summary (en) Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. When using the built-in `extract32(b, start)`, if the `start` index provided has for side effect to update `b`, the byte array to extract `32` bytes from, it could be that some dirty memory is read and returned by `extract32`. This vulnerability affects 0.3.10 and earlier versions. (en) Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. When using the built-in `extract32(b, start)`, if the `start` index provided has for side effect to update `b`, the byte array to extract `32` bytes from, it could be that some dirty memory is read and returned by `extract32`. This vulnerability is fixed in 0.4.0.
References
  • () https://github.com/vyperlang/vyper/commit/3d9c537142fb99b2672f21e2057f5f202cde194f -

26 Feb 2024, 20:19

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-26 20:19

Updated : 2025-01-16 19:34

NVD link : CVE-2024-24564

Mitre link : CVE-2024-24564

CVE.ORG link : CVE-2024-24564

JSON object : View

Products Affected

vyperlang

  • vyper
CWE
CWE-125

Out-of-bounds Read