CVE-2024-24561: 
Python vulnerability analysis and mitigation

CVE-2024-24561 is a high-severity vulnerability in the Vyper programming language affecting versions <=0.3.10. The vulnerability exists in the built-in slice() function where the bounds check does not account for potential overflow when using non-literal arguments for the start or length parameters. This vulnerability was discovered and disclosed on January 31, 2024, affecting the core functionality of the Vyper language (GitHub Advisory).

The vulnerability stems from an inadequate bounds check implementation in the slice() function. When calling slice() on a storage value, compile-time bounds checks only work if the start and length values are literals. For non-literal values, the runtime check performs a simple comparison (["assert", ["le", ["add", start, length], src_len]]) which fails to account for integer overflow scenarios. This oversight allows attackers to bypass the bounds check through arithmetic overflow, enabling out-of-bounds access to storage, memory, or calldata addresses (GitHub Advisory).

The vulnerability can be exploited in two main ways: 1) Out-of-bounds (OOB) access to storage, allowing attackers to potentially read unrelated storage slots and return unintended values, and 2) Length slot corruption, where attackers can manipulate the length parameter to read dirty memory. In most cases, this could result in forcing a zero return for the slice operation even when it shouldn't be possible (GitHub Advisory).

The vulnerability is exploitable when using non-literal arguments for the start or length parameters in the slice() function. A contract search was performed and no vulnerable contracts were found in production. Proof of Concept exploits have demonstrated both OOB access and length corruption scenarios (GitHub Advisory).

The vulnerability has been patched in Vyper version 0.4.0. Users should upgrade to this version or later to mitigate the risk. The fix was implemented through PR #3818 (GitHub Advisory).