[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cve-CVE-2024-32649":3},{"id":4,"cve_id":5,"euvd_id":6,"summary":7,"published":8,"cvss_data":9,"is_remote":19,"cwes":20,"cpes":23,"technologies":26,"references":29,"score":35,"epss_score":36,"epss_percentile":37,"is_kev":38,"cisa_kev_date_added":39,"cisa_kev_due_date":39,"cisa_ssvc":40,"attack_mappings":50,"exploits":78},49662,"CVE-2024-32649","EUVD-2024-0185","vyper performs multiple eval of `sqrt()` argument built in\n\n### Summary\nUsing the `sqrt` builtin can result in multiple eval evaluation of side effects when the argument has side-effects. The bug is more difficult (but not impossible!) to trigger as of 0.3.4, when the unique symbol fence was introduced (https:\u002F\u002Fgithub.com\u002Fvyperlang\u002Fvyper\u002Fpull\u002F2914).\n\nA contract search was performed and no vulnerable contracts were found in production.\n\n### Details\nIt can be seen that the `build_IR` function of the `sqrt` builtin doesn't cache the argument to the stack: \nhttps:\u002F\u002Fgithub.com\u002Fvyperlang\u002Fvyper\u002Fblob\u002F4595938734d9988f8e46e8df38049ae0559abedb\u002Fvyper\u002Fbuiltins\u002Ffunctions.py#L2151\n\nAs such, it can be evaluated multiple times (instead of retrieving the value from the stack).\n\n### PoC\nWith at least Vyper version `0.2.15+commit.6e7dba7` the following contract:\n```vyper\nc: uint256\n\n@internal\ndef some_decimal() -> decimal:\n    self.c += 1\n    return 1.0\n\n@external\ndef foo() -> uint256:\n    k: decimal = sqrt(self.some_decimal())\n    return self.c\n```\npasses the following test:\n```solidity\n\u002F\u002F SPDX-License-Identifier: MIT\npragma solidity >=0.8.13;\n\nimport \"..\u002F..\u002Flib\u002Fds-test\u002Ftest.sol\";\nimport \"..\u002F..\u002Flib\u002Futils\u002FConsole.sol\";\nimport \"..\u002F..\u002Flib\u002Futils\u002FVyperDeployer.sol\";\n\nimport \"..\u002FITest.sol\";\n\ncontract ConTest is DSTest {\n    VyperDeployer vyperDeployer = new VyperDeployer();\n\n    ITest t;\n\n    function setUp() public {\n        t = ITest(vyperDeployer.deployContract(\"Test\"));\n    }\n\n    function testFoo() public {\n        uint256 val = t.foo();\n        console.log(val);\n        assert (val == 4);\n    }\n}\n```\n \n### Patches\nPatched in https:\u002F\u002Fgithub.com\u002Fvyperlang\u002Fvyper\u002Fpull\u002F3976.\n\n### Impact\nNo vulnerable production contracts were found.","2024-04-25T19:50:00Z",{"cvss_v3.1":10},{"scope":11,"version":12,"baseScore":13,"attackVector":14,"baseSeverity":15,"vectorString":16,"integrityImpact":17,"userInteraction":18,"attackComplexity":17,"availabilityImpact":18,"privilegesRequired":18,"confidentialityImpact":18},"UNCHANGED","3.1",5.3,"NETWORK","MEDIUM","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","LOW","NONE",true,[21,22],"CWE-95","NVD-CWE-Other",[24,25],"cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:python:*:*","cpe:2.3:a:vyper:vyper:*:*:*:*:*:*:*:*",[27,28],"Vyperlang Vyper","Vyper Vyper",[30,31,32,33,34],"https:\u002F\u002Fgithub.com\u002Fvyperlang\u002Fvyper\u002Fsecurity\u002Fadvisories\u002FGHSA-5jrj-52x8-m64h","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-32649","https:\u002F\u002Fgithub.com\u002Fvyperlang\u002Fvyper\u002Fpull\u002F2914","https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fvyper\u002FPYSEC-2024-209.yaml","https:\u002F\u002Fgithub.com\u002Fvyperlang\u002Fvyper",0.47,0.00455,0.3925,false,null,{"timestamp":41,"automatable":42,"tech_impact":43,"exploitation":44,"cisa_decision":45,"cisa_remediation_timeline":49},"2024-04-29T12:16:42.844342Z","yes","partial","poc",{"vector":46,"decision":47,"priority":48},"CISAv1\u002FE:P\u002FA:Y\u002FT:P\u002FM:H\u002F2026-10-25T17:39:06.852685\u002F","attend","medium","14D",[51,57,66,72],{"name":52,"source":53,"tactics":54,"technique_id":56},"Exploit Public-Facing Application","attack_vector",[55],"initial-access","T1190",{"name":58,"source":59,"cwe_ids":60,"tactics":61,"capec_ids":63,"technique_id":65},"HTML Smuggling","capec",[21],[62],"stealth",[64],"CAPEC-35","T1027.006",{"name":67,"source":59,"cwe_ids":68,"tactics":69,"capec_ids":70,"technique_id":71},"Embedded Payloads",[21],[62],[64],"T1027.009",{"name":73,"source":59,"cwe_ids":74,"tactics":75,"capec_ids":76,"technique_id":77},"Resource Forking",[21],[62],[64],"T1564.009",[]]