Описание
WasmEdge is a WebAssembly runtime. Prior to version 0.16.0-alpha.3, a multiplication in WasmEdge/include/runtime/instance/memory.h can wrap, causing checkAccessBound() to incorrectly allow the access. This leads to a segmentation fault. Version 0.16.0-alpha.3 contains a patch for the issue.
A flaw was found in WasmEdge, a WebAssembly runtime. A multiplication error within the checkAccessBound() function can lead to incorrect memory access. This vulnerability allows a remote attacker to trigger a segmentation fault, causing the program to crash and resulting in a Denial of Service (DoS).
Отчет
This vulnerability is rated Moderate for Red Hat products as it leads to a Denial of Service in WasmEdge. A remote attacker can trigger a segmentation fault by exploiting an incorrect memory access within the checkAccessBound() function. This affects WasmEdge in Community Projects (EPEL, Fedora) and OpenShift Container Platform, potentially causing the runtime to crash.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat OpenShift Container Platform 4 | rhcos | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | wasmedge | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.3 Medium
CVSS3
Связанные уязвимости
WasmEdge is a WebAssembly runtime. Prior to version 0.16.0-alpha.3, a multiplication in `WasmEdge/include/runtime/instance/memory.h` can wrap, causing `checkAccessBound()` to incorrectly allow the access. This leads to a segmentation fault. Version 0.16.0-alpha.3 contains a patch for the issue.
WasmEdge is a WebAssembly runtime. Prior to version 0.16.0-alpha.3, a multiplication in `WasmEdge/include/runtime/instance/memory.h` can wrap, causing `checkAccessBound()` to incorrectly allow the access. This leads to a segmentation fault. Version 0.16.0-alpha.3 contains a patch for the issue.
WasmEdge is a WebAssembly runtime. Prior to version 0.16.0-alpha.3, a ...
EPSS
5.3 Medium
CVSS3