CVE-2021-41121

Memory corruption in Vyper (before 0.3.0) due to struct function call

• CVSS 8.8
• CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
• Memory Corruption
• Remote

Vyper is a Pythonic Smart Contract Language for the EVM. In affected versions when performing a function call inside a literal struct, there is a memory corruption issue that occurs because of an incorrect pointer to the the top of the stack. This issue has been resolved in version 0.3.0.

CVE

CVE-2021-41121

CWE

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

CVSS base score

8.8

Published

2021-10-05

OWASP

A04 Insecure Design

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Memory Corruption

Subcategory

Buffer Overflows

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update to Vyper version 0.3.0 or higher

def vulnerable_function(user_input):
    """Function vulnerable to the described security issue."""
    # VULNERABLE: Unsafe handling of user input
    return process_unsafe(user_input)

def secure_function(user_input):
    """Secure function that safely processes user input."""
    # SECURE: Validate and sanitize input before processing
    if not isinstance(user_input, str) or len(user_input) > 1000:
        raise ValueError("Invalid input")
    
    # Use safe processing methods
    result = safe_process(user_input)
    return result

@misc{vaitp:cve202141121,
  title        = {{Memory corruption in Vyper (before 0.3.0) due to struct function call}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2021},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2021-41121},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2021-41121/}}
}