CVE-2018-17293: Null Pointer Dereference
An issue was discovered in WAVM before 2018-09-16. The run function in Programs/wavm/wavm.cpp does not check whether there is Emscripten memory to store the command-line arguments passed by the input WebAssembly file's main function, which allows attackers to cause a denial of service (application crash by NULL pointer dereference) or possibly have unspecified other impact by crafting certain WebAssembly files.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2018-17293?
CVE-2018-17293 has a medium severity rating due to its potential to cause denial of service.
How do I fix CVE-2018-17293?
To fix CVE-2018-17293, ensure you are using a version of WAVM that was released after September 16, 2018.
What type of attack does CVE-2018-17293 enable?
CVE-2018-17293 enables a denial of service attack by exploiting unchecked memory allocation for command-line arguments.
Which software is affected by CVE-2018-17293?
CVE-2018-17293 affects WAVM versions released before September 16, 2018.
What could an attacker do with CVE-2018-17293?
An attacker could leverage CVE-2018-17293 to crash the WAVM application by causing memory issues.