Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1wcHg1LXEzNTktcHZ3as4AA7UK

vyper's range(start, start + N) reverts for negative numbers

Summary

When looping over a range of the form range(start, start + N), if start is negative, the execution will always revert.

Details

This issue is caused by an incorrect assertion inserted by the code generation of the range (stmt.parse_For_range()):

https://github.com/vyperlang/vyper/blob/9136169468f317a53b4e7448389aa315f90b95ba/vyper/codegen/stmt.py#L286-L287

This assertion was introduced in https://github.com/vyperlang/vyper/commit/3de1415ee77a9244eb04bdb695e249d3ec9ed868 to fix https://github.com/advisories/GHSA-6r8q-pfpv-7cgj. The issue arises when start is signed, instead of using sle, le is used and start is interpreted as an unsigned integer for the comparison. If it is a negative number, its 255th bit is set to 1 and is hence interpreted as a very large unsigned integer making the assertion always fail.

PoC

@external
def foo():
    x:int256 = min_value(int256)
    # revert when it should not since we have the following assertion that fails:
    # [assert, [le, min_value(int256), max_value(int256) + 1 - 10]],
    for i in range(x, x + 10):
        pass

Patches

patched in v0.4.0, specifically, https://github.com/vyperlang/vyper/pull/3679 disallows this form of range().

Impact

Any contract having a range(start, start + N) where start is a signed integer with the possibility for start to be negative is affected. If a call goes through the loop while supplying a negative start the execution will revert.

Permalink: https://github.com/advisories/GHSA-ppx5-q359-pvwj
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wcHg1LXEzNTktcHZ3as4AA7UK
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 9 months ago
Updated: 9 months ago

CVSS Score: 5.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS Percentage: 0.00045
EPSS Percentile: 0.17541

Identifiers: GHSA-ppx5-q359-pvwj, CVE-2024-32481
References:

• https://github.com/vyperlang/vyper/security/advisories/GHSA-ppx5-q359-pvwj
• https://nvd.nist.gov/vuln/detail/CVE-2024-32481
• https://github.com/vyperlang/vyper/commit/3de1415ee77a9244eb04bdb695e249d3ec9ed868
• https://github.com/vyperlang/vyper/commit/5319cfbe14951e007ccdb323257e5ada869b35d5
• https://github.com/vyperlang/vyper/blob/9136169468f317a53b4e7448389aa315f90b95ba/vyper/codegen/stmt.py#L286-L287
• https://github.com/advisories/GHSA-ppx5-q359-pvwj

Repository: https://github.com/vyperlang/vyper
Blast Radius: 12.6

Affected Packages