CVE-2024-32646: falha de média gravidade em vyperlang vyper
vyper performs double eval of the slice args when buffer from adhoc locations
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.5%
Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `slice` builtin can result in a double eval vulnerability when the buffer argument is either `msg.data`, `self.code` or `<address>.code` and either the `start` or `length` arguments have side-effects. It can be easily triggered only with the versions `<0.3.4` as `0.3.4` introduced the unique symbol fence. No vulnerable production contracts were found. Additionally, double evaluation of side-effects should be easily discoverable in client tests. As such, the impact is low. As of time of publication, no fixed versions are available.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
vyperlang · vyperCVEs relacionadas — vyperlang vyper
No mesmo produto, das mais perigosas para as menos.
CVE-2024-24563CRITICALVyper array negative index vulnerabilityEPSS 1.5%CVE-2022-24845HIGHInteger bounds error in VyperEPSS 1.4%CVE-2022-29255HIGHMultiple evaluation of contract address in call in vyperEPSS 1.3%CVE-2023-31146HIGHVyper vulnerable to OOB DynArray access when array is on both LHS and RHS of an assignmentEPSS 1.3%CVE-2021-41121HIGHMemory corruption in VyperEPSS 1.1%CVE-2022-24787HIGHIncorrect Comparison in VyperEPSS 1.0%