CVE-2024-36761
📋 TL;DR
CVE-2024-36761 is a critical stack overflow vulnerability in naga v0.14.0's WGSL parser that allows attackers to execute arbitrary code or cause denial of service. This affects any application using the vulnerable naga library for WebGPU Shading Language processing. The high CVSS score of 9.8 indicates this is easily exploitable and can lead to complete system compromise.
💻 Affected Systems
- naga
📦 What is this software?
Naga by Gfx Rs
Wgpu by Gfx Rs
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system takeover, data exfiltration, or ransomware deployment.
Likely Case
Application crash or denial of service, potentially allowing privilege escalation in multi-user environments.
If Mitigated
Limited to denial of service if memory protections are enabled, but still significant availability impact.
🎯 Exploit Status
The vulnerability is in the parser component and can be triggered by specially crafted WGSL shader code without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v0.14.1 or later
Vendor Advisory: https://github.com/gfx-rs/naga/issues/2591
Restart Required: Yes
Instructions:
1. Update naga dependency to v0.14.1 or later. 2. Rebuild and redeploy affected applications. 3. Restart services using the updated library.
🔧 Temporary Workarounds
Input Validation
allImplement strict validation of WGSL shader inputs before passing to naga parser
Memory Limit Enforcement
linuxUse operating system controls to limit stack size for processes using naga
ulimit -s 8192 # Linux example to limit stack to 8MB
🧯 If You Can't Patch
- Isolate naga processing to dedicated containers with minimal privileges
- Implement network segmentation to limit exposure of vulnerable services
🔍 How to Verify
Check if Vulnerable:
Check if naga v0.14.0 is in your dependency tree: cargo tree | grep nagaCheck Version:
cargo list | grep nagaVerify Fix Applied:
Verify naga version is v0.14.1 or later: cargo list | grep naga📡 Detection & Monitoring
Log Indicators:
- Segmentation fault errors
- Stack overflow exceptions
- Abnormal process termination
Network Indicators:
- Unusual WGSL shader submissions
- Large payloads to shader processing endpoints
SIEM Query:
process.name:naga AND (event.type:crash OR error.message:"stack overflow")