CVE-2021-45290 – This vulnerability in Binaryen 103 allows attac... (How to Fix)

Q: What is the severity of CVE-2021-45290?

CVE-2021-45290 has a CVSS score of 7.5 (HIGH). This vulnerability in Binaryen 103 allows attackers to cause a Denial of Service (DoS) by triggering an assertion abort in the wasm::handle_unreachable function. It affects systems using Binaryen for WebAssembly compilation and optimization. The vulnerability can crash applications that process malicious WebAssembly modules.

📋 TL;DR

This vulnerability in Binaryen 103 allows attackers to cause a Denial of Service (DoS) by triggering an assertion abort in the wasm::handle_unreachable function. It affects systems using Binaryen for WebAssembly compilation and optimization. The vulnerability can crash applications that process malicious WebAssembly modules.

💻 Affected Systems

Products:

Binaryen

Versions: Binaryen 103

Operating Systems: Linux, Windows, macOS, Other Unix-like systems

Default Config Vulnerable: ⚠️ Yes

Notes: Affects any system using Binaryen 103 for WebAssembly compilation. Fedora Linux packages were specifically mentioned in advisories.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete service disruption where applications using Binaryen crash when processing malicious WebAssembly input, potentially affecting dependent services.

🟠

Likely Case

Application crashes when processing untrusted WebAssembly modules, leading to temporary service unavailability until restart.

🟢

If Mitigated

Minimal impact if systems only process trusted WebAssembly modules or have proper input validation and sandboxing.

🌐 Internet-Facing: MEDIUM - WebAssembly compilation services exposed to the internet could be targeted with malicious modules.

🏢 Internal Only: LOW - Internal systems processing only trusted WebAssembly modules have limited exposure.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires feeding a specially crafted WebAssembly module to Binaryen. No public proof-of-concept was found in references.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Binaryen 104 or later

Vendor Advisory: https://github.com/WebAssembly/binaryen/issues/4383

Restart Required: Yes

Instructions:

1. Check current Binaryen version. 2. Update to Binaryen 104 or later using package manager or source compilation. 3. Restart any services using Binaryen.

🔧 Temporary Workarounds

Input Validation

all

Validate and sanitize WebAssembly modules before processing with Binaryen

Process Isolation

all

Run Binaryen in isolated containers or sandboxes to limit crash impact

🧯 If You Can't Patch

Implement strict input validation for WebAssembly modules
Deploy Binaryen in containerized environments with automatic restart capabilities

🔍 How to Verify

Check if Vulnerable:

Check Binaryen version: binaryen --version or check installed package version

Check Version:

binaryen --version

Verify Fix Applied:

Verify version is 104 or later: binaryen --version | grep -q 'version 10[4-9]\|version [1-9][0-9][0-9]'

📡 Detection & Monitoring

Log Indicators:

Application crashes with assertion failures
Process termination logs mentioning Binaryen or wasm::handle_unreachable

Network Indicators:

Unusual WebAssembly module uploads to compilation services

SIEM Query:

process_name:"binaryen" AND (event_type:"crash" OR exit_code:!0)

📊 Metadata

CVE ID: CVE-2021-45290

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-617

Published: December 21, 2021

Last Updated: November 21, 2024

🔗 References

https://github.com/WebAssembly/binaryen/issues/4383 Exploit,Issue Tracking,Patch,Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKGCHPS7UAIOOBGSXDJAUFE5CROTTF6J/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YCWLB4PWYQO55F7IGNC7KUYN2MFZE3JP/
https://github.com/WebAssembly/binaryen/issues/4383 Exploit,Issue Tracking,Patch,Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKGCHPS7UAIOOBGSXDJAUFE5CROTTF6J/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YCWLB4PWYQO55F7IGNC7KUYN2MFZE3JP/

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-45290, you might also want to check these: