CVE-2023-52284

Severity Score

5.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Bytecode Alliance wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) before 1.3.0 can have an "double free or corruption" error for a valid WebAssembly module because push_pop_frame_ref_offset is mishandled.

Bytecode Alliance wasm-micro-runtime (también conocido como WebAssembly Micro Runtime o WAMR) anterior a 1.3.0 puede tener un error de "double free or corruption" para un módulo WebAssembly válido porque push_pop_frame_ref_offset no se maneja correctamente.

*Credits: N/A

CVSS Scores

NISTv3.1 5.5

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2023-12-31 CVE Reserved
2023-12-31 CVE Published
2024-01-09 EPSS Updated
2024-08-02 CVE Updated
2024-08-02 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-415: Double Free

CAPEC

References (3)

URL	Tag	Source

URL	Date	SRC
https://github.com/bytecodealliance/wasm-micro-runtime/issues/2586	2024-08-02

URL	Date	SRC
https://github.com/bytecodealliance/wasm-micro-runtime/compare/WAMR-1.2.3...WAMR-1.3.0	2024-01-08
https://github.com/bytecodealliance/wasm-micro-runtime/pull/2590	2024-01-08

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Bytecodealliance Search vendor "Bytecodealliance"		Webassembly Micro Runtime Search vendor "Bytecodealliance" for product "Webassembly Micro Runtime"				< 1.3.0 Search vendor "Bytecodealliance" for product "Webassembly Micro Runtime" and version " < 1.3.0"		-		Affected