CVE-2020-18378: Null Pointer Dereference
Published Aug 22, 2023
·Updated
A NULL pointer dereference was discovered in SExpressionWasmBuilder::makeBlock in wasm/wasm-s-parser.c in Binaryen 1.38.26. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm-as.
Affected Software
1 affected component
Webassembly Binaryen=1.38.26
Event History
Aug 22, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What is CVE-2020-18378?
CVE-2020-18378 is a vulnerability discovered in Binaryen 1.38.26 that allows for a NULL pointer dereference in SExpressionWasmBuilder::makeBlock in wasm/wasm-s-parser.c, leading to denial-of-service.
2
How severe is CVE-2020-18378?
CVE-2020-18378 has a severity score of 6.5 (medium).
3
What software is affected by CVE-2020-18378?
Webassembly Binaryen version 1.38.26 is affected by CVE-2020-18378.
4
How can CVE-2020-18378 be exploited?
A crafted wasm input can cause a segmentation fault, leading to denial-of-service.
5
Is there a fix available for CVE-2020-18378?
To fix CVE-2020-18378, it is recommended to update to a version of Binaryen that contains the fix.