CVE-2023-41052 Vyper: incorrect order of evaluation of side effects for some builtins

What is CVE-2023-41052?

CVE-2023-41052 is a low-severity vulnerability in vyperlang vyper, published on 4 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Vyper is a Pythonic Smart Contract Language. In affected versions the order of evaluation of the arguments of the builtin functions `uint256_addmod`, `uint256_mulmod`, `ecadd` and `ecmul` does not follow source order. This behaviour is problematic when the evaluation of one of the arguments produces side effects that other arguments depend on. A patch is currently being developed on pull request #3583. When using builtins from the list above, users should make sure that the arguments of the expression do not produce side effects or, if one does, that no other argument is dependent on those side effects.

Weakness: CWE-670

Which versions are affected by CVE-2023-41052?

3 open source packages ship an affected version, including vyper. It affects 1 product.

Products include Vyperlang Vyper.

How do I fix CVE-2023-41052?

Upgrade vyper to a fixed version for your release line: 0.3.10 or 0.3.10rc1.

Is CVE-2023-41052 being exploited?

There is no known exploitation of CVE-2023-41052 in the wild and no public exploit code.

Other vulnerabilities in vyperlang vyper

• CVE-2024-24563 Vyper array negative index vulnerability Critical 9.8
• CVE-2024-24561 Vyper bounds check on built-in `slice()` function can be overflowed Critical 9.8
• CVE-2023-39363 Vyper incorrectly allocated named re-entrancy locks Critical 9.1
• CVE-2022-24845 Integer bounds error in Vyper High 8.8
• CVE-2022-29255 Multiple evaluation of contract address in call in vyper High 8.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4hg4-9mf5-wxxq, PYSEC-2023-168.