Vyper up to 0.3.7 integer overflow

Summaryinfo

A vulnerability was found in Vyper up to 0.3.7. It has been rated as problematic. The impacted element is an unknown function. The manipulation leads to integer overflow. This vulnerability is documented as CVE-2023-32058. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Vyper up to 0.3.7. It has been rated as problematic. This issue affects an unknown function. The manipulation with an unknown input leads to a integer overflow vulnerability. Using CWE to declare the problem leads to CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. Impacted is availability. The summary by CVE is:

Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, due to missing overflow check for loop variables, by assigning the iterator of a loop to a variable, it is possible to overflow the type of the latter. The issue seems to happen only in loops of type `for i in range(a, a + N)` as in loops of type `for i in range(start, stop)` and `for i in range(stop)`, the compiler is able to raise a `TypeMismatch` when trying to overflow the variable. The problem has been patched in version 0.3.8.

The weakness was released 05/12/2023 as GHSA-6r8q-pfpv-7cgj. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2023-32058 since 05/01/2023. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 0.3.8 eliminates this vulnerability. Applying the patch 3de1415ee77a9244eb04bdb695e249d3ec9ed868 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Vyper

Version

• 0.3.0
• 0.3.1
• 0.3.2
• 0.3.3
• 0.3.4
• 0.3.5
• 0.3.6
• 0.3.7

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion