CVE-2024-32481

{"id": "CVE-2024-32481", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2024-04-25T17:15:50.273", "references": [{"url": "https://github.com/vyperlang/vyper/blob/9136169468f317a53b4e7448389aa315f90b95ba/vyper/codegen/stmt.py#L286-L287", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/vyperlang/vyper/commit/3de1415ee77a9244eb04bdb695e249d3ec9ed868", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/vyperlang/vyper/commit/5319cfbe14951e007ccdb323257e5ada869b35d5", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-ppx5-q359-pvwj", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/vyperlang/vyper/blob/9136169468f317a53b4e7448389aa315f90b95ba/vyper/codegen/stmt.py#L286-L287", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/vyperlang/vyper/commit/3de1415ee77a9244eb04bdb695e249d3ec9ed868", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/vyperlang/vyper/commit/5319cfbe14951e007ccdb323257e5ada869b35d5", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-ppx5-q359-pvwj", "tags": ["Exploit", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-681"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-681"}]}], "descriptions": [{"lang": "en", "value": "Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Starting in version 0.3.8 and prior to version 0.4.0b1, when looping over a `range` of the form `range(start, start + N)`, if `start` is negative, the execution will always revert. This issue is caused by an incorrect assertion inserted by the code generation of the range `stmt.parse_For_range()`. The issue arises when `start` is signed, instead of using `sle`, `le` is used and `start` is interpreted as an unsigned integer for the comparison. If it is a negative number, its 255th bit is set to `1` and is hence interpreted as a very large unsigned integer making the assertion always fail. Any contract having a `range(start, start + N)` where `start` is a signed integer with the possibility for `start` to be negative is affected. If a call goes through the loop while supplying a negative `start` the execution will revert. Version 0.4.0b1 fixes the issue."}, {"lang": "es", "value": "Vyper es un lenguaje de contrato inteligente pit\u00f3nico para la m\u00e1quina virtual Ethereum. A partir de la versi\u00f3n 0.3.8 y antes de la versi\u00f3n 0.4.0b1, al recorrer un \"rango\" de la forma \"rango (inicio, inicio + N)\", si \"inicio\" es negativo, la ejecuci\u00f3n siempre se revertir\u00e1. Este problema se debe a una aserci\u00f3n incorrecta insertada durante la generaci\u00f3n de c\u00f3digo del rango `stmt.parse_For_range()`. El problema surge cuando se firma \"start\", en lugar de usar \"sle\", se usa \"le\" y \"start\" se interpreta como un entero sin signo para la comparaci\u00f3n. Si es un n\u00famero negativo, su bit 255 se establece en \"1\" y, por lo tanto, se interpreta como un entero sin signo muy grande, lo que hace que la afirmaci\u00f3n siempre falle. Cualquier contrato que tenga un \"rango (inicio, inicio + N)\" donde \"inicio\" es un entero con signo con la posibilidad de que \"inicio\" sea negativo se ve afectado. Si una llamada pasa por el bucle mientras proporciona un \"inicio\" negativo, la ejecuci\u00f3n se revertir\u00e1. La versi\u00f3n 0.4.0b1 soluciona el problema."}], "lastModified": "2025-05-05T17:31:53.233", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:python:*:*", "vulnerable": true, "matchCriteriaId": "1E5F82EF-A6F3-40FE-A247-768110F75FF5", "versionEndIncluding": "0.3.10", "versionStartIncluding": "0.3.8"}, {"criteria": "cpe:2.3:a:vyperlang:vyper:0.4.0:-:*:*:*:python:*:*", "vulnerable": true, "matchCriteriaId": "67A97C59-2377-4E39-AA46-283C57DE4DAD"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}