WebAssembly Micro Runtime: Heap Buffer Overflow in WAMR WASI poll_oneoff Output Buffer

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to 2.4.5, wasi_poll_oneoff in core/iwasm/libraries/libc-wasi/libc_wasi_wrapper.c validates the output pointer for only one wasi_event_t, while wasmtime_ssp_poll_oneoff in core/iwasm/libraries/libc-wasi/sandboxed-system-primitives/src/posix.c can write as many events as the guest-controlled nsubscriptions value. A crafted guest module can provide multiple subscriptions that produce events while positioning an output region large enough for only one event, causing a later out[nevents] write to cross the validated Wasm linear-memory boundary into adjacent host heap memory. The overwrite contains partly attacker-controlled event data and can reliably crash the host process, with further confidentiality or integrity consequences depending on heap layout. This issue is fixed in version 2.4.5.

Etkilenen sürümler1 yazılım

Kaynaklar6 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…untime/security/advisories/GHSA-wj3p-xhqm-pffc Diğer
• github.com/…ommit/1f98fb01d09b2ef5e49dc0be2e6006f962fd87f1 Diğer
• github.com/…ommit/b49d10eac4176817305d60ea59d24bc69a53eb7b Diğer
• github.com/…ime/wasm-micro-runtime/releases/tag/WAMR-2.4.5 Diğer

Kayıt geçmişi

1. 5 Kas 2026 20:27Yayımlandı

İlgili açıklar

• 8,8 CVE-2026-54912WAMR fast interpreter loader heap buffer overflow via constant deduplication mismatch
• 6,9 CVE-2026-54913WebAssembly Micro Runtime: Missing `ref.null` heap-type validation in `load_init_expr` leaks host stack memory to the WebAssembly guest
• 8,2 CVE-2026-116788FreeSWITCH: Pre-authentication heap buffer overflow in core XML empty-entity decoding
• 9,1 CVE-2026-116785FreeSWITCH: Pre-authentication heap out-of-bounds write in mod_xml_rpc WebSocket frame length handling
• 6,5 CVE-2026-123205accel-ppp before 1.15.0 Heap-based Buffer Overflow via oversized log lines in log_tcp/log_syslog/log_pgsql
• 7,3 CVE-2026-112109Local privilege escalation in SafeNet Authentication Client SACSrv