CVE-2021-41121: Memory corruption in Vyper

Q: What is the vulnerability ID for this issue?

The vulnerability ID is CVE-2021-41121.

Q: What is the impact of this vulnerability?

The impact of this vulnerability is a memory corruption issue.

Q: What is the affected software?

The affected software is Vyperlang Vyper up to version 0.3.0.

Q: How can I fix this vulnerability?

To fix this vulnerability, upgrade to version 0.3.0 of Vyperlang Vyper.

Published Oct 6, 2021

Updated

Impact

When performing a function call inside a literal struct, there is a memory corruption issue that occurs because of an incorrect pointer to the the top of the stack.

Patches 0.3.0 / #2447

Other sources

Vyper is a Pythonic Smart Contract Language for the EVM. In affected versions when performing a function call inside a literal struct, there is a memory corruption issue that occurs because of an incorrect pointer to the the top of the stack. This issue has been resolved in version 0.3.0.

Affected Software

2 affected componentsFixes available

pip/vyper<0.3.0

0.3.0

vyperlang vyper<0.3.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/vyper to a version that resolves this vulnerability.
Fixed in 0.3.0
Upgrade
Upgrade Vyper to a version that resolves this vulnerability.
Fixed in 0.3.0Patch #2447

Event History

Oct 6, 2021

CVE Published

via MITRE·05:10 PM

Data Sourced

via MITRE·05:10 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Oct 12, 2021

Advisory Published

via GitHub·03:59 PM

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID is CVE-2021-41121.

What is Vyper?

Vyper is a Pythonic Smart Contract Language for the EVM.

What is the impact of this vulnerability?