CVE-2024-28123
Assigner: GitHub_M
Published: 2024-03-08T21:29:53.555Z
State: PUBLISHED
title: Wasmi Out-of-bounds Write for host to Wasm calls with more than 128 Parameters
problemTypes: descriptions: cweId: CWE-787
description: CWE-787: Out-of-bounds Write
type: CWE
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
affected: vendor: wasmi-labs
product: wasmi
versions: version: >= 0.15.0, <= 0.31.0
status: affected
descriptions: value: Wasmi is an efficient and lightweight WebAssembly interpreter with a focus on constrained and embedded systems. In the WASMI Interpreter, an Out-of-bounds Buffer Write will arise if the host calls or resumes a Wasm function with more parameters than the default limit (128), as it will surpass the stack value. This doesn’t affect calls from Wasm to Wasm, only from host to Wasm. This vulnerability was patched in version 0.31.1.

source: advisory: GHSA-75jp-vq8x-h4cq
discovery: UNKNOWN