CVE-2024-27529: Wasm3 uncontrolled memory allocation in Read_utf8

CVE-2024-27529 · Severity: high · CVSS 8.4 · Published 2024-11-09

Wasm3, a high-performance WebAssembly interpreter, is vulnerable to a memory leak when processing specially crafted files. An attacker could provide a malicious WebAssembly binary that causes the application to consume excessive memory, potentially leading to a system crash or service outage. This affects applications using Wasm3 to run untrusted code in environments like IoT devices, mobile apps, or web services.

Technologies: wasm3 (crates.io), pywasm3 (PyPI). Vendors: crates.io, PyPI, Swift.

Quick answers

Is CVE-2024-27529 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-27529 being exploited in the wild.
How severe is CVE-2024-27529?
High severity, with a CVSS score of 8.4, published 9 November 2024.
Which products and versions are affected?
wasm3 (crates.io) <= 0.3.1; pywasm3 (PyPI) <= 0.5.0, ECOSYSTEM:introduced=0,last_affected=139076a; github.com/shareup/wasm-interpreter-apple (Swift) <= 0.8.1.
Is there a fix for CVE-2024-27529?
A patch was published on 2024-08-02: Fix merged into main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-27529 attacked?
It is attacked over the network or with local access, in a software library.
Am I affected by CVE-2024-27529?
Check whether you run wasm3 (crates.io), pywasm3 (PyPI) or github.com/shareup/wasm-interpreter-apple (Swift) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A memory leak exists in Wasm3 (specifically at commit 139076a and earlier) within the Read_utf8 function and M3Module memory import handling. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-125 (Out-of-bounds Read). An attacker can exploit this by providing a crafted WebAssembly (.wasm) binary that triggers underruns or failed releases of allocated memory during parsing. This can lead to a Denial of Service (DoS) through memory exhaustion. While some metrics suggest local access, the nature of WebAssembly interpreters often involves processing remote content, extending the risk to network vectors. A fix was merged in commit 526c125.

Affected products

  • wasm3 project wasm3 <= 0.3.1 (Rust), <= 0.5.0 (pip), <= 0.8.1 (Swift)

Identifiers

  • CVE-2024-27529
  • GHSA-fmq6-4w57-2w3v
  • PYSEC-2024-305

Timeline

  • 2024-02-19: disclosed: Issue reported on GitHub
  • 2024-08-02: patched: Fix merged into main branch
  • 2024-11-08: advisory: NVD publication date
  • 2024-11-09: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.