Quick answers
- Is CVE-2024-34249 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2024-34249 being exploited in the wild.
- How severe is CVE-2024-34249?
- Critical severity, with a CVSS score of 9.8, published 6 May 2024.
- Which products and versions are affected?
- pywasm3 (PyPI) <= 0.5.0, ECOSYSTEM:introduced=0,last_affected=0.5.0.
- Is there a fix for CVE-2024-34249?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2024-34249 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2024-34249?
- Check whether you run pywasm3 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A heap-based buffer overflow (CWE-122) exists in wasm3 v0.5.0 and its Python binding pywasm3 within the 'DeallocateSlot' function in 'm3_compile.c'. The vulnerability is triggered during the compilation phase of a WebAssembly module, specifically when handling nested blocks or stack operations that lead to an out-of-bounds memory access. An attacker can exploit this by providing a malicious .wasm file to be processed by the interpreter. Successful exploitation can result in a segmentation fault (DoS) or potentially remote code execution with the privileges of the application. As of the advisory date, no official patch has been released for version 0.5.0.
Affected products
- wasm3 pywasm3 <= 0.5.0
- wasm3 wasm3 0.5.0
Identifiers
- CVE-2024-34249
- GHSA-mq9p-qw76-q6h7
- PYSEC-2024-308
Timeline
- 2024-05-06: disclosed: CVE-2024-34249 published
- 2024-05-06: advisory: GitHub Advisory GHSA-mq9p-qw76-q6h7 published