Junglewise Threat Intelligence

CVE-2024-27529: Wasm3 uncontrolled memory allocation in Read_utf8

CVE-2024-27529 · Severity: high · CVSS 8.4 · Published 2024-11-09

Technologies: pywasm3 (PyPI), wasm3 (crates.io). Vendors: PyPI, crates.io, Swift.

Executive brief

Wasm3, a high-performance WebAssembly interpreter, is vulnerable to a memory leak when processing specially crafted files. An attacker could provide a malicious WebAssembly binary that causes the application to consume excessive memory, potentially leading to a system crash or service outage. This affects applications using Wasm3 to run untrusted code in environments like IoT devices, mobile apps, or web services.

Technical details

A memory leak exists in Wasm3 (specifically at commit 139076a and earlier) within the Read_utf8 function and M3Module memory import handling. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-125 (Out-of-bounds Read). An attacker can exploit this by providing a crafted WebAssembly (.wasm) binary that triggers underruns or failed releases of allocated memory during parsing. This can lead to a Denial of Service (DoS) through memory exhaustion. While some metrics suggest local access, the nature of WebAssembly interpreters often involves processing remote content, extending the risk to network vectors. A fix was merged in commit 526c125.

Affected products

  • wasm3 project wasm3 <= 0.3.1 (Rust), <= 0.5.0 (pip), <= 0.8.1 (Swift)

Timeline

  • 2024-02-19: disclosed: Issue reported on GitHub
  • 2024-08-02: patched: Fix merged into main branch
  • 2024-11-08: advisory: NVD publication date
  • 2024-11-09: advisory: GitHub Advisory published

References

Related threats