CVE-2024-28123
📋 TL;DR
This vulnerability in the WASMI WebAssembly interpreter allows an out-of-bounds buffer write when the host calls or resumes a Wasm function with more than 128 parameters, exceeding the stack limit. This only affects calls from host to Wasm, not Wasm-to-Wasm calls. Systems using vulnerable versions of WASMI for WebAssembly execution in constrained/embedded environments are affected.
💻 Affected Systems
- WASMI (WebAssembly interpreter)
📦 What is this software?
Wasmi by Wasmi Labs
⚠️ Risk & Real-World Impact
Worst Case
Arbitrary code execution leading to complete system compromise, data corruption, or denial of service in affected systems.
Likely Case
Application crashes, denial of service, or potential memory corruption leading to unstable behavior.
If Mitigated
Limited impact with proper input validation and parameter limits in place before calls to WASMI.
🎯 Exploit Status
Exploitation requires the ability to trigger host-to-Wasm calls with excessive parameters. No public exploit code has been identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.31.1
Vendor Advisory: https://github.com/wasmi-labs/wasmi/security/advisories/GHSA-75jp-vq8x-h4cq
Restart Required: Yes
Instructions:
1. Update WASMI to version 0.31.1 or later. 2. Rebuild any applications using WASMI. 3. Restart affected services. 4. Verify the update was successful.
🔧 Temporary Workarounds
Parameter validation
allImplement input validation to ensure host-to-Wasm calls never exceed 128 parameters
Implement parameter count checks in host code before calling WASMI functions
Limit host capabilities
allRestrict host environments from making direct calls to Wasm functions with variable parameters
Implement wrapper functions that validate parameter counts
🧯 If You Can't Patch
- Implement strict input validation to ensure no host-to-Wasm calls exceed 128 parameters
- Isolate WASMI usage in sandboxed environments with limited privileges
🔍 How to Verify
Check if Vulnerable:
Check WASMI version in your project dependencies or installed packages. If version is <0.31.1, you are vulnerable.Check Version:
Check package manifest (Cargo.toml for Rust) or run: wasmi --version if availableVerify Fix Applied:
Confirm WASMI version is 0.31.1 or later and test host-to-Wasm calls with various parameter counts.📡 Detection & Monitoring
Log Indicators:
- Application crashes
- Memory access violation errors
- Stack overflow warnings
- Unexpected termination of WASMI processes
Network Indicators:
- Unusual traffic patterns to services using WASMI
- Increased error rates in WebAssembly-related services
SIEM Query:
Search for: (process_name:"wasmi" OR process_name:"*wasm*") AND (event_type:"crash" OR event_type:"memory_violation" OR error_code:"SIGSEGV")🔗 References
- https://github.com/wasmi-labs/wasmi/commit/f7b3200e9f3dc9e2cbca966cb255c228453c792f
- https://github.com/wasmi-labs/wasmi/releases/tag/v0.31.1
- https://github.com/wasmi-labs/wasmi/security/advisories/GHSA-75jp-vq8x-h4cq
- https://github.com/wasmi-labs/wasmi/commit/f7b3200e9f3dc9e2cbca966cb255c228453c792f
- https://github.com/wasmi-labs/wasmi/releases/tag/v0.31.1
- https://github.com/wasmi-labs/wasmi/security/advisories/GHSA-75jp-vq8x-h4cq
