CVE-2024-22419: Vyper concat built-in memory corruption

CVE-2024-22419 · Severity: low · CVSS 3.1 · Published 2024-01-18

Vyper is a smart contract programming language for Ethereum. A vulnerability in the concat() function allows attackers to write past the allocated memory buffer, overwriting adjacent data and potentially altering contract behavior or corrupting stored values like immutables and local variables. This is a memory safety issue that can silently corrupt contract state without triggering obvious errors.

Technologies: vyper (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2024-22419 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-22419 being exploited in the wild.
How severe is CVE-2024-22419?
Low severity, with a CVSS score of 3.1, published 18 January 2024.
Which products and versions are affected?
vyper (PyPI) ECOSYSTEM:introduced=0.3.0,fixed=0.4.0, GIT:introduced=0,fixed=55e18f6d128b2da8986adbbcccf1cd59a4b9ad6f|ECOSYSTEM:introduced=0,fixed=0.4.0b1.
Is there a fix for CVE-2024-22419?
Yes. vyper (PyPI): upgrade to 0.4.0, 0.4.0b1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-22419 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2024-22419?
Check whether you run vyper (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • vyper (PyPI): upgrade to 0.4.0, 0.4.0b1 or later
    pip install "vyper>=0.4.0b1"

Technical details

The concat() built-in function allocates a memory buffer but incorrectly uses the copy_bytes() function to copy string/bytes arguments, which may copy entire 32-byte words even when only 1 byte is requested. When the destination buffer's remaining space is less than 32 bytes, this word-sized write overflows the buffer boundary and corrupts adjacent memory. The vulnerability is triggered primarily when concat() is called within an internal function that is invoked from an external function; the memory layout in this scenario places the internal function's data below the caller's data, allowing the overflow to corrupt the caller's local variables and immutables. Both memory and storage sources can cause the corruption. The issue affects Vyper ≤0.3.10 and was patched in 0.4.0.

Affected products

  • Vyper Vyper <=0.3.10

Identifiers

  • CVE-2024-22419
  • GHSA-2q8v-3gqq-4f8p
  • PYSEC-2024-103

Timeline

  • 2024-01-19: disclosed
  • 2024-01-19: patched: patched in Vyper 0.4.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.