by Kastro
Paper/Archive/CVE-2023-31146

CVE-2023-31146

vyperlang vyper — Vyper vulnerable to OOB DynArray access when array is on both LHS and RHS of an assignment

EPSS 1%CVSS 9.1
critical.is priorityof 100
41
CVSS 9.1 (ADP, NVD agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 69.4.694 × 2013.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, during codegen, the length word of a dynarray is written before the data, which can result in out-of-bounds array access in the case where the dynarray is on both the lhs and rhs of an assignment. The issue can cause data corruption across call frames. The expected behavior is to revert due to out-of-bounds array access. Version 0.3.8 contains a patch for this issue.

Affected

ProductAffectedFixed inSource
vyper< 0.3.8–CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
GitHub_M (CNA)7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refgithub.com/vyperlang/vyper/security/advisories/GHSA-3p37-3636-q8wvrefgithub.com/vyperlang/vyper/commit/4f8289a81206f767df1900ac48f485d90fc87edb