Is CVE-2024-27530 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-27530 being exploited in the wild.

How severe is CVE-2024-27530?

High severity, with a CVSS score of 8.4, published 9 November 2024.

Which products and versions are affected?

pywasm3 (PyPI) <= 0.5.0, ECOSYSTEM:introduced=0,last_affected=0.5.0, ECOSYSTEM:introduced=0,last_affected=139076a.

Is there a fix for CVE-2024-27530?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2024-27530 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2024-27530?

Check whether you run pywasm3 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-27530: wasm3 pywasm3 use-after-free in ForEachModule

Q: Which products and versions are affected?

pywasm3 (PyPI) <= 0.5.0, ECOSYSTEM:introduced=0,last_affected=0.5.0, ECOSYSTEM:introduced=0,last_affected=139076a.

Q: Is there a fix for CVE-2024-27530?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2024-27530 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2024-27530?

Check whether you run pywasm3 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-27530 · Severity: high · CVSS 8.4 · Published 2024-11-09

pywasm3 is a Python wrapper for Wasm3, a fast WebAssembly interpreter used to run portable code across different platforms. A memory management flaw allows a specially crafted WebAssembly file to crash the application or potentially execute unauthorized code. This could lead to a complete loss of system confidentiality and availability if an attacker can convince a user or automated process to load a malicious file.

Technologies: pywasm3 (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2024-27530 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-27530 being exploited in the wild.
How severe is CVE-2024-27530?: High severity, with a CVSS score of 8.4, published 9 November 2024.
Which products and versions are affected?: pywasm3 (PyPI) <= 0.5.0, ECOSYSTEM:introduced=0,last_affected=0.5.0, ECOSYSTEM:introduced=0,last_affected=139076a.
Is there a fix for CVE-2024-27530?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2024-27530 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2024-27530?: Check whether you run pywasm3 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free (UAF) vulnerability exists in the ForEachModule function within m3_env.c of the Wasm3 interpreter (and its Python binding pywasm3). The flaw is triggered during module cleanup or when handling function signature mismatches, where the runtime attempts to access memory associated with a module that has already been freed. An attacker can exploit this by providing a malformed WebAssembly (.wasm) file. Successful exploitation can lead to arbitrary code execution or a denial-of-service (DoS) condition. The vulnerability was identified in commit 139076a and affects pywasm3 versions up to 0.5.0. No official patch was confirmed at the time of the advisory.

Affected products

wasm3 pywasm3 <= 0.5.0
wasm3 wasm3 139076a

Identifiers

CVE-2024-27530
GHSA-46r6-92jg-22jg
PYSEC-2024-306

Timeline

2024-02-05: disclosed: Issue reported on GitHub repository
2024-11-08: advisory: NVD published CVE-2024-27530
2024-11-09: advisory: GitHub Advisory GHSA-46r6-92jg-22jg published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.