PT-2024-22276 · Wasmi · Wasmi

Robbepop · Published 2024-03-07 · Updated 2025-06-02 · CVE-2024-28123

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wasmi versions 0.15.0 through 0.31.0

Description The issue arises when the host calls or resumes a Wasm function with more parameters than the default limit (128), causing an Out-of-bounds Buffer Write. This affects calls from host to Wasm, but not calls from Wasm to Wasm.

Recommendations For Wasmi versions 0.15.0 through 0.31.0, update to version 0.31.1 to resolve the issue. As a temporary workaround, ensure that no more than 128 parameters can be passed in a call from the host to a Wasm function.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2024-28123

GHSA-75JP-VQ8X-H4CQ

Affected Products

Wasmi

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28123.json · Exploit
• https://github.com/wasmi-labs/wasmi/commit/f7b3200e9f3dc9e2cbca966cb255c228453c792f · Patch
• https://github.com/wasmi-labs/wasmi/security/advisories/GHSA-75jp-vq8x-h4cq · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-75jp-vq8x-h4cq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28123 · Security Note
• https://osv.dev/vulnerability/CVE-2024-28123 · Vendor Advisory
• https://github.com/wasmi-labs/wasmi · Note
• https://github.com/wasmi-labs/wasmi/releases/tag/v0.31.1 · Note
• https://twitter.com/cracbot/status/1771321531416657983 · Twitter Post
• https://twitter.com/CVEnew/status/1766216887841550554 · Twitter Post
• https://t.me/cvenotify/124341 · Telegram Post