CVE-2023-41052: Vyper: incorrect order of evaluation of side effects for some builtins
First published: Mon Sep 04 2023(Updated: )
### Impact The order of evaluation of the arguments of the builtin functions `uint256_addmod`, `uint256_mulmod`, `ecadd` and `ecmul` does not follow source order. • For `uint256_addmod(a,b,c)` and `uint256_mulmod(a,b,c)`, the order is `c,a,b`. • For `ecadd(a,b)` and `ecmul(a,b)`, the order is `b,a`. Note that this behaviour is problematic when the evaluation of one of the arguments produces side effects that other arguments depend on. ### Patches https://github.com/vyperlang/vyper/pull/3583 ### Workarounds When using builtins from the list above, make sure that the arguments of the expression do not produce side effects or, if one does, that no other argument is dependent on those side effects. ### References _Are there any links users can visit to find out more?_
Credit: security-advisories@github.com security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Vyperlang Vyper | <=0.3.9 | |
| pip/vyper | <=0.3.9 | 0.3.10rc1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/vyperlang/vyper/pull/3583
- https://github.com/vyperlang/vyper/security/advisories/GHSA-4hg4-9mf5-wxxq
- https://nvd.nist.gov/vuln/detail/CVE-2023-41052
- https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-168.yaml
- https://github.com/advisories/GHSA-4hg4-9mf5-wxxq (Advisory)
Frequently Asked Questions
What is CVE-2023-41052?
CVE-2023-41052 is a vulnerability in the Vyper smart contract language where the order of evaluation of certain builtin functions does not follow source order.
What is the impact of CVE-2023-41052?
The impact of CVE-2023-41052 is that the order of evaluation for certain builtin functions in Vyper is inconsistent, which can lead to unexpected behavior or vulnerabilities in smart contracts.
How can I fix CVE-2023-41052?
To fix CVE-2023-41052, update to Vyper version 0.3.10 or later.
What is the severity of CVE-2023-41052?
CVE-2023-41052 has a severity rating of 5.3, which is considered medium severity.
What is the CWE ID of CVE-2023-41052?
The CWE ID of CVE-2023-41052 is 670.
- collector/nvd-api
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/title
- agent/weakness
- agent/references
- agent/description
- agent/event
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-4hg4-9mf5-wxxq
- alias/CVE-2023-41052
- agent/software-canonical-lookup
- agent/last-modified-date
- collector/nvd-cve
- source/NVD
- agent/author
- collector/github-advisory
- agent/tags
- agent/softwarecombine
- agent/trending
- vendor/vyperlang
- canonical/vyperlang vyper
- version/vyperlang vyper/0.3.9
- package-manager/pip