Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security] Out-of-Bound Memory Write on "op_SetSlot_i64" Function #474

Open
mobsceneZ opened this issue Apr 22, 2024 · 0 comments
Open

[Security] Out-of-Bound Memory Write on "op_SetSlot_i64" Function #474

mobsceneZ opened this issue Apr 22, 2024 · 0 comments

Comments

@mobsceneZ
Copy link

Environment

OS               : Linux 5.15.146.1-microsoft-standard-WSL2 #1 SMP Thu Jan 11 04:09:03 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
Commit           : 139076a98b8321b67f850a844f558b5e91b5ac83
Version          : 0.5.0
Clang Verison    : 13.0.0
Build            : mkdir -p build && cd build && export CC="clang" CXX="clang++" CFLAGS="-fsanitize=address -g" CXXFLAGS="-fsanitize=address -g" && cmake .. && make -j8
Affected Tool    : wasm3
Enabled Features : None
Impact           : Out-of-Bound Memory Write
Command          : wasm3/build/wasm3 --func main poc.wasm
Validation       : Invalid **(therefore possibly related to incomplete validation in wasm3)**

Proof of Concept

wasm3-poc-06.zip

Stack Trace Provide By AddressSanitizer

AddressSanitizer:DEADLYSIGNAL
=================================================================
==20112==ERROR: AddressSanitizer: SEGV on unknown address 0x63100003b188 (pc 0x00000053029f bp 0x62d000000418 sp 0x7ffea3365fd0 T0)
==20112==The signal is caused by a WRITE memory access.
    #0 0x53029f in op_SetSlot_i64 /home/lain/wasm3/source/./m3_exec.h:963:1
    #1 0x53ed46 in RunCode /home/lain/wasm3/source/./m3_exec_defs.h:71:5
    #2 0x53ed46 in m3_CallArgv /home/lain/wasm3/source/m3_env.c:1013:25
    #3 0x4f947e in repl_call /home/lain/wasm3/platforms/app/main.c:298:14
    #4 0x4fafe3 in main /home/lain/wasm3/platforms/app/main.c
    #5 0x7f07fcf6a082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
    #6 0x41ea5d in _start (/home/lain/wasm3/build/wasm3+0x41ea5d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/lain/wasm3/source/./m3_exec.h:963:1 in op_SetSlot_i64
==20112==ABORTING
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

1 participant