Executive brief
Wasm3, a high-performance WebAssembly interpreter, is vulnerable to a memory leak when processing specially crafted files. An attacker could provide a malicious WebAssembly binary that causes the application to consume excessive memory, potentially leading to a system crash or service outage. This affects applications using Wasm3 to run untrusted code in environments like IoT devices, mobile apps, or web services.
Technical details
A memory leak exists in Wasm3 (specifically at commit 139076a and earlier) within the Read_utf8 function and M3Module memory import handling. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-125 (Out-of-bounds Read). An attacker can exploit this by providing a crafted WebAssembly (.wasm) binary that triggers underruns or failed releases of allocated memory during parsing. This can lead to a Denial of Service (DoS) through memory exhaustion. While some metrics suggest local access, the nature of WebAssembly interpreters often involves processing remote content, extending the risk to network vectors. A fix was merged in commit 526c125.
Affected products
- wasm3 project wasm3 <= 0.3.1 (Rust), <= 0.5.0 (pip), <= 0.8.1 (Swift)
Timeline
- 2024-02-19: disclosed: Issue reported on GitHub
- 2024-08-02: patched: Fix merged into main branch
- 2024-11-08: advisory: NVD publication date
- 2024-11-09: advisory: GitHub Advisory published
References
- https://github.com/wasm3/wasm3/issues/462
- https://gist.github.com/haruki3hhh/ac70bd83b9c0ed1de6289d818488da78
- https://github.com/wasm3/wasm3/pull/490
- https://github.com/wasm3/wasm3/commit/526c1251b64e6e9fdc0d40c768ae46cd20338594
- https://github.com/pypa/advisory-database/tree/main/vulns/pywasm3/PYSEC-2024-305.yaml