Project: wasm-micro-runtime (bytecodealliance/wasm-micro-runtime), language: c++
Vulnerability instance: wamr.cve-2024-25431
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/bytecodealliance/wasm-micro-runtime/issues/3122
## Description:
Issue: bytecodealliance/wasm-micro-runtime#3122
Title: Invalid Read Memory in check_wasi_abi_compatibility
State: closed
Created by: haruki3hhh
Created at: 2024-02-03 03:14:15+00:00
Labels: bug, fixed, wasm loader

Issue Body:
## Version
commit b3f728ceb36f9c72047a934436ef41699643ab99 (HEAD -> main, origin/main, origin/HEAD)
Author: Wenyong Huang <wenyong.huang@intel.com>
Date:   Thu Feb 1 12:42:12 2024 +0800

## Compile
```sh
cd wasm-micro-runtime/product-mini/platforms/linux/
cmake -DCMAKE_C_COMPILER="gcc" -DCMAKE_C_FLAGS="-g -fsanitize=address -fno-omit-frame-pointer" -DCMAKE_LINKER_FLAGS="-g -fsanitize=address -fno-omit-frame-pointer" ..
make -j
```

## Reproduce
```sh
./iwasm id\:000000\,sig\:06\,src\:001224\,op\:python\,pos\:0
```

## ASAN Log
```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1546471==ERROR: AddressSanitizer: SEGV on unknown address 0x603800000368 (pc 0x55f3ba9bb762 bp 0x7ffd6d5a03c0 sp 0x7ffd6d5a0260 T0)
==1546471==The signal is caused by a READ memory access.
    #0 0x55f3ba9bb761 in check_wasi_abi_compatibility /root/Ablation/wasm-micro-runtime/core/iwasm/interpreter/wasm_loader.c:4276
    #1 0x55f3ba9bb761 in wasm_loader_load /root/Ablation/wasm-micro-runtime/core/iwasm/interpreter/wasm_loader.c:4383
    #2 0x55f3ba93171c in main /root/Ablation/wasm-micro-runtime/product-mini/platforms/linux/../posix/main.c:885
    #3 0x7f74763de082 in __libc_start_main ../csu/libc-start.c:308
    #4 0x55f3ba932b2d in _start (/root/Ablation/wasm-micro-runtime/product-mini/platforms/linux/build_asan/iwasm+0x22b2d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /root/Ablation/wasm-micro-runtime/core/iwasm/interpreter/wasm_loader.c:4276 in check_wasi_abi_compatibility
==1546471==ABORTING
```
## PoC
[PoC](https://github.com/haruki3hhh/fuzzing/blob/main/id%3A000000%2Csig%3A06%2Csrc%3A001224%2Cop%3Apython%2Cpos%3A0)




Comments:
Comment by wenyongh on 2024-02-04 09:28:38+00:00:
@haruki3hhh thanks for spotting the issue, it was fixed with #3126.

---

Comment by wenyongh on 2024-03-15 05:48:20+00:00:
Close the issue since it had been fixed.

Commit References:
b3f728ceb36f9c72047a934436ef41699643ab99

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
  -DCMAKE_C_FLAGS="${CFLAGS}"
  -DCMAKE_CXX_FLAGS="${CXXFLAGS}"
  -DCMAKE_EXE_LINKER_FLAGS="${LDFLAGS}"
  -DCMAKE_MODULE_LINKER_FLAGS="${LDFLAGS}"
  -DCMAKE_SHARED_LINKER_FLAGS="${LDFLAGS}"
  cmake -S . -B build_loader \
      "${cmake_args[@]}" \
    && cmake --build build_loader

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt upgrade -y && apt install -y build-essential clang llvm
RUN apt install -y build-essential clang llvm
RUN git clone https://github.com/bytecodealliance/wasm-micro-runtime wasm-micro-runtime
RUN git -C wasm-micro-runtime checkout b3f728ceb36f9c72047a934436ef41699643ab99
WORKDIR $SRC/wasm-micro-runtime
COPY build.sh $SRC/

Additional files: