CVE-2023-52284: Double Free
Bytecode Alliance wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) before 1.3.0 can have an "double free or corruption" error for a valid WebAssembly module because pushpopframerefoffset is mishandled.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52284?
CVE-2023-52284 has been classified with a high severity due to the potential for double free or corruption errors affecting the stability of WebAssembly modules.
How do I fix CVE-2023-52284?
To fix CVE-2023-52284, update the wasm-micro-runtime to version 1.3.0 or later.
What software is affected by CVE-2023-52284?
CVE-2023-52284 affects all versions of wasm-micro-runtime prior to 1.3.0 from Bytecode Alliance.
What types of exploits are possible with CVE-2023-52284?
Exploiting CVE-2023-52284 could lead to application crashes or potential arbitrary code execution due to memory corruption.
Is CVE-2023-52284 a vulnerability in WebAssembly itself?
No, CVE-2023-52284 specifically affects the wasm-micro-runtime implementation, not the WebAssembly specification.