CVE-2024-32481: vyper's range(start, start + N) reverts for negative numbers
Summary
When looping over a range of the form range(start, start + N), if start is negative, the execution will always revert. Details
This issue is caused by an incorrect assertion inserted by the code generation of the range (stmt.parseForrange()):
https://github.com/vyperlang/vyper/blob/9136169468f317a53b4e7448389aa315f90b95ba/vyper/codegen/stmt.py#L286-L287
This assertion was introduced in https://github.com/vyperlang/vyper/commit/3de1415ee77a9244eb04bdb695e249d3ec9ed868 to fix https://github.com/advisories/GHSA-6r8q-pfpv-7cgj. The issue arises when start is signed, instead of using sle, le is used and start is interpreted as an unsigned integer for the comparison. If it is a negative number, its 255th bit is set to 1 and is hence interpreted as a very large unsigned integer making the assertion always fail. PoC
Vyper @external def foo(): x:int256 = minvalue(int256) # revert when it should not since we have the following assertion that fails: # [assert, [le, minvalue(int256), maxvalue(int256) + 1 - 10]], for i in range(x, x + 10): pass
Patches
patched in v0.4.0, specifically, https://github.com/vyperlang/vyper/pull/3679 disallows this form of range().
Impact
Any contract having a range(start, start + N) where start is a signed integer with the possibility for start to be negative is affected. If a call goes through the loop while supplying a negative start the execution will revert.
Other sources
Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Starting in version 0.3.8 and prior to version 0.4.0b1, when looping over a range of the form range(start, start + N), if start is negative, the execution will always revert. This issue is caused by an incorrect assertion inserted by the code generation of the range stmt.parseForrange(). The issue arises when start is signed, instead of using sle, le is used and start is interpreted as an unsigned integer for the comparison. If it is a negative number, its 255th bit is set to 1 and is hence interpreted as a very large unsigned integer making the assertion always fail. Any contract having a range(start, start + N) where start is a signed integer with the possibility for start to be negative is affected. If a call goes through the loop while supplying a negative start the execution will revert. Version 0.4.0b1 fixes the issue.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-32481?
CVE-2024-32481 is a critical vulnerability that can cause execution to revert when using negative starting values in the range function.
How do I fix CVE-2024-32481?
To fix CVE-2024-32481, update the Vyper package to version 0.4.0 or later.
What software is affected by CVE-2024-32481?
CVE-2024-32481 affects Vyper versions between 0.3.8 and 0.4.0, including the exact version 0.4.0.
What happens if I use a negative start value in Vyper range due to CVE-2024-32481?
Using a negative start value in a range will cause the program to revert, leading to potential execution failures.
Is CVE-2024-32481 a widely known vulnerability?
Yes, CVE-2024-32481 is recognized within the developer community due to its impact on the Vyper programming language.