CVE-2024-26149

Array index overflow in Vyper's `_abi_decode` can lead to exploits.

• CVSS 5.3
• CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
• Input Validation and Sanitization
• Remote

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. If an excessively large value is specified as the starting index for an array in `_abi_decode`, it can cause the read position to overflow. This results in the decoding of values outside the intended array bounds, potentially leading to exploitations in contracts that use arrays within `_abi_decode`. This vulnerability affects 0.3.10 and earlier versions.

CVE

CVE-2024-26149

CWE

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

CVSS base score

5.3

Published

2024-02-26

OWASP

A01 Broken Access Control

Orthogonal defect classification

Algorithm

Code defect classification

Incorrect Algorithm

Category

Input Validation and Sanitization

Subcategory

Integer Overflows

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

Vyper

Fixed by upgrading

Yes

Solution

Upgrade to Vyper version 0.3.11 or later to mitigate the vulnerability.

def abi_decode(data, start_index, length):
    return data[start_index:start_index + length]

data = [1, 2, 3, 4, 5]
start_index = 2**32
length = 3
decoded_values = abi_decode(data, start_index, length)
print(decoded_values)

def abi_decode(data, start_index, length):
    if start_index < 0 or start_index + length > len(data):
        raise ValueError("Invalid start index or length for decoding.")
    return data[start_index:start_index + length]

data = [1, 2, 3, 4, 5]
start_index = 2**32
length = 3
decoded_values = abi_decode(data, start_index, length)
print(decoded_values)

data = [1, 2, 3, 4, 5]  # Example data array
start_index = 2**32  # Excessively large index to trigger overflow
length = 10  # Length that exceeds the data array bounds

@misc{vaitp:cve202426149,
  title        = {{Array index overflow in Vyper's `_abi_decode` can lead to exploits.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-26149},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-26149/}}
}