CVE-2024-27532
📋 TL;DR
A NULL pointer dereference vulnerability in wasm-micro-runtime's block_type_get_result_types function allows attackers to cause denial of service or potentially execute arbitrary code. This affects systems running vulnerable versions of WAMR that process untrusted WebAssembly modules. The vulnerability is triggered when parsing malicious WebAssembly binaries.
💻 Affected Systems
- wasm-micro-runtime (WAMR)
📦 What is this software?
Webassembly Micro Runtime by Bytecodealliance
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise if combined with other vulnerabilities or memory corruption techniques.
Likely Case
Application crash and denial of service when processing malicious WebAssembly modules.
If Mitigated
Limited impact with proper sandboxing and input validation in place.
🎯 Exploit Status
Proof of concept available in GitHub issue. Exploitation requires ability to submit malicious WebAssembly binaries to the runtime.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check latest WAMR releases after commit 06df58f
Vendor Advisory: https://github.com/bytecodealliance/wasm-micro-runtime/issues/3130
Restart Required: Yes
Instructions:
1. Update to latest WAMR version. 2. Rebuild applications using WAMR. 3. Restart affected services.
🔧 Temporary Workarounds
Input Validation
allValidate all WebAssembly binaries before processing with WAMR
Sandbox Execution
linuxRun WAMR in isolated containers or sandboxes to limit impact
docker run --security-opt=no-new-privileges -it wamr-container
🧯 If You Can't Patch
- Implement strict input validation for all WebAssembly binaries
- Isolate WAMR execution in containers with limited privileges
🔍 How to Verify
Check if Vulnerable:
Check if WAMR version includes commit 06df58f or earlier. Test with proof-of-concept WebAssembly module from GitHub issue.Check Version:
Check WAMR source code or build information for commit hashVerify Fix Applied:
Verify WAMR version is updated beyond vulnerable commit. Test with same proof-of-concept module to confirm no crash.📡 Detection & Monitoring
Log Indicators:
- Application crashes
- Segmentation faults in WAMR processes
- Unexpected termination of WebAssembly runtime
Network Indicators:
- Unusual WebAssembly binary uploads
- Repeated failed WebAssembly execution attempts
SIEM Query:
process_name:"wamr" AND (event_type:"crash" OR exit_code:139)