CVE-2024-27530

Vulnerability

A use-after-free vulnerability exists in wasm3 at commit 139076a in the ForEachModule function located in source/m3_env.c (line 211). The bug occurs when a crafted WebAssembly module is loaded and then freed, but a subsequent call to ForEachModule accesses the freed memory. The AddressSanitizer log from the issue report confirms a heap-use-after-free read of size 8 bytes [1][2].

Exploitation

An attacker can trigger this vulnerability by providing a specially crafted WebAssembly file to the wasm3 runtime. The sequence involves parsing the malicious module via m3_ParseModule, which allocates memory, then the module is freed during repl_load (e.g., due to a signature mismatch), and finally ForEachModule is called during runtime cleanup (e.g., Runtime_Release or m3_FreeRuntime), reading from the freed memory region [1]. No authentication or special network position is required; the attack can be remote if the runtime processes untrusted wasm files.

Impact

Successful exploitation can lead to arbitrary code execution or denial of service. The advisory explicitly lists both code execution and denial of service as impacts [2]. The use-after-free allows an attacker to control the freed memory contents, potentially hijacking control flow or causing a crash.

Mitigation

As of the publication date (2024-11-08), no official patch or fixed version has been released for this vulnerability. The issue remains open in the wasm3 repository [1]. Users should avoid processing untrusted WebAssembly files with the affected commit 139076a until a fix is available. No workaround is documented.