CVE-2022-24788: Buffer overflow in Vyper
Impact Importing a function from a JSON interface which returns bytes generates bytecode which does not clamp bytes length, potentially resulting in a buffer overrun.
Patches 0.3.2 (as of https://github.com/vyperlang/vyper/commit/049dbdc647b2ce838fae7c188e6bb09cf16e470b)
Workarounds Use .vy interfaces.
Other sources
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Versions of vyper prior to 0.3.2 suffer from a potential buffer overrun. Importing a function from a JSON interface which returns bytes generates bytecode which does not clamp bytes length, potentially resulting in a buffer overrun. Users are advised to upgrade. There are no known workarounds for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-24788?
CVE-2022-24788 is a vulnerability in the Vyper smart contract language for the Ethereum Virtual Machine (EVM).
How does CVE-2022-24788 impact Vyper?
CVE-2022-24788 can potentially result in a buffer overrun when importing a function from a JSON interface in Vyper versions prior to 0.3.2.
What can happen if CVE-2022-24788 is exploited?
Exploiting CVE-2022-24788 could allow an attacker to perform arbitrary code execution or cause a denial-of-service (DoS) condition.
How can I fix CVE-2022-24788?
To fix CVE-2022-24788, update Vyper to version 0.3.2 or later.
What is the severity of CVE-2022-24788?
CVE-2022-24788 has a severity rating of 9.8, which is classified as critical.