GitHub Advisoryadvisory · crates.io, Go

GHSA-75qh-gg76-p2w4 CWA-2023-004: Excessive number of function parameters in compiled Wasm

MEDIUM Published 2024-08-27 Modified 2024-12-23 Official page ↗
Ecosystem
crates.io, Go
Packages
cosmwasm-vm, github.com/CosmWasm/wasmvm
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-400
Reviewed
2024-08-27

Affected packages

• crates.io cosmwasm-vm: < 1.2.8 → fixed in 1.2.8 • crates.io cosmwasm-vm: >= 1.3.0, < 1.3.4 → fixed in 1.3.4 • crates.io cosmwasm-vm: >= 1.4.0, < 1.4.2 → fixed in 1.4.2 • crates.io cosmwasm-vm: >= 1.5.0, < 1.5.1 → fixed in 1.5.1 • Go github.com/CosmWasm/wasmvm: < 1.2.5 → fixed in 1.2.5 • Go github.com/CosmWasm/wasmvm: >= 1.3.0, < 1.3.1 → fixed in 1.3.1 • Go github.com/CosmWasm/wasmvm: >= 1.4.0, < 1.4.2 → fixed in 1.4.2 • Go github.com/CosmWasm/wasmvm: >= 1.5.0, < 1.5.1 → fixed in 1.5.1

Description

A specifically crafted Wasm file can cause the VM to consume excessive amounts of memory when compiling a contract. This can lead to high memory usage, slowdowns, potentially a crash and can poison a lock in the VM, preventing any further interaction with contracts. For more information, see CWA-2023-004.

Related

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References