PT-2024-25767 · Wasm3 · Wasm3

Mobscenez · Published 2024-05-06 · Updated 2024-07-03 · CVE-2024-34249

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions wasm3 version 0.5.0

Description A heap buffer overflow was discovered in wasm3, leading to a segmentation fault via the DeallocateSlot function in m3 compile.c. This issue requires local network access to exploit.

Recommendations Update to a patched version when available. Restrict local network access to minimize the risk of exploitation. As a temporary workaround, consider restricting access to the DeallocateSlot function until a patch is available.

Fix

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

CVE-2024-34249

PYSEC-2024-308

Affected Products

Wasm3

References · 7

• https://github.com/wasm3/wasm3/issues/485 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-34249 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-34249 · Security Note
• https://osv.dev/vulnerability/PYSEC-2024-308 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1787527609510777279 · Twitter Post
• https://twitter.com/oktsec/status/1787551132484558929 · Twitter Post
• https://twitter.com/CVEnew/status/1787510876473262276 · Twitter Post