| タイトル | WebAssembly Community Binaryen main branch commit 3ef8d19 (v117 development version, vulnerable version before fix commit 1251efb) Fixed version: commit 1251ef Assertion Failure, Denial of Service (Local DoS) |
|---|
| 説明 | Binaryen is an open-source WebAssembly compiler optimization toolchain maintained by the WebAssembly Community.
A local denial-of-service vulnerability exists in the BrOn instruction parsing module of the wasm-ctor-eval utility.
During BrOn instruction parsing, the program fails to validate whether the `ref` and `desc` operands are legal reference types. Malicious crafted non-reference type Wasm bytecode will flow into the subsequent finalize() logic, and trigger an assertion failure check `isRef()` in Type::getHeapType() at src/wasm-type.h line 407. The wasm-ctor-eval process crashes and exits abnormally immediately, causing denial of service.
Crash detail:
wasm-ctor-eval: /home/new-cases/binaryen/latestest-04.21/binaryen-main/src/wasm-type.h:407: wasm::HeapType wasm::Type::getHeapType() const: Assertion `isRef()' failed.
[1] 1774067 IOT instruction
Original reported issue: https://github.com/WebAssembly/binaryen/issues/8633
Official fix pull request: https://github.com/WebAssembly/binaryen/pull/8635
Fix commit: 1251efb
Official fix summary: Avoid assertion failure by adding reference type validation in BrOn parsing stage. |
|---|
| ソース | ⚠️ https://github.com/WebAssembly/binaryen/issues/8633,https://github.com/WebAssembly/binaryen/pull/8635 |
|---|
| ユーザー | pwn3rd (UID 97480) |
|---|
| 送信 | 2026年04月22日 02:18 (6 月 ago) |
|---|
| モデレーション | 2026年05月10日 16:57 (19 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 362554 [WebAssembly Binaryen 迄 117 BrOn Parser wasm-ir-builder.cpp IRBuilder::makeBrOn サービス拒否] |
|---|
| ポイント | 20 |
|---|