Executive brief
pywasm3 is a Python wrapper for Wasm3, a fast WebAssembly interpreter used to run portable code across different platforms. A memory management flaw allows a specially crafted WebAssembly file to crash the application or potentially execute unauthorized code. This could lead to service disruptions or the compromise of systems running untrusted WebAssembly modules.
Technical details
A heap-based buffer overflow (CWE-122) exists in wasm3 v0.5.0 and its Python binding pywasm3 within the 'DeallocateSlot' function in 'm3_compile.c'. The vulnerability is triggered during the compilation phase of a WebAssembly module, specifically when handling nested blocks or stack operations that lead to an out-of-bounds memory access. An attacker can exploit this by providing a malicious .wasm file to be processed by the interpreter. Successful exploitation can result in a segmentation fault (DoS) or potentially remote code execution with the privileges of the application. As of the advisory date, no official patch has been released for version 0.5.0.
Affected products
- wasm3 pywasm3 <= 0.5.0
- wasm3 wasm3 0.5.0
Timeline
- 2024-05-06: disclosed: CVE-2024-34249 published
- 2024-05-06: advisory: GitHub Advisory GHSA-mq9p-qw76-q6h7 published