CVE-2022-24845 Integer bounds error in Vyper

What is CVE-2022-24845?

CVE-2022-24845 is a high-severity vulnerability in vyperlang vyper, published on 13 Apr 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In affected versions, the return of `<iface>.returns_int128()` is not validated to fall within the bounds of `int128`. This issue can result in a misinterpretation of the integer value and lead to incorrect behavior. As of v0.3.0, `<iface>.returns_int128()` is validated in simple expressions, but not complex expressions. Users are advised to upgrade. There is no known workaround for this issue.

Weakness: CWE-190

Which versions are affected by CVE-2022-24845?

3 open source packages ship an affected version, including vyper. It affects 1 product.

Products include Vyperlang Vyper.

How do I fix CVE-2022-24845?

Upgrade vyper to 0.3.2 or later.

Is CVE-2022-24845 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-24845 exists.

Other vulnerabilities in vyperlang vyper

• CVE-2024-24563 Vyper array negative index vulnerability Critical 9.8
• CVE-2024-24561 Vyper bounds check on built-in `slice()` function can be overflowed Critical 9.8
• CVE-2023-39363 Vyper incorrectly allocated named re-entrancy locks Critical 9.1
• CVE-2022-29255 Multiple evaluation of contract address in call in vyper High 8.2
• CVE-2023-42443 Vyper vulnerable to memory corruption in certain builtins utilizing `msize` High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-j2x6-9323-fp7h, PYSEC-2022-198.