CVE-2019-7153 : Security Advisory and Response

In Binaryen 1.38.22, a vulnerability was found in the function wasm::WasmBinaryBuilder::processFunctions() located in wasm/wasm-binary.cpp. This vulnerability occurs when calling wasm::WasmBinaryBuilder::getFunctionIndexName and results in a NULL pointer dereference. By providing a carefully crafted input, an attacker can exploit this vulnerability to cause segmentation faults, leading to denial-of-service. This vulnerability has been demonstrated using wasm-opt.

Understanding CVE-2019-7153

This CVE-2019-7153 vulnerability affects Binaryen 1.38.22, specifically in the function wasm::WasmBinaryBuilder::processFunctions() in wasm/wasm-binary.cpp.

What is CVE-2019-7153?

CVE-2019-7153 is a NULL pointer dereference vulnerability in Binaryen 1.38.22, triggered by calling wasm::WasmBinaryBuilder::getFunctionIndexName. It allows attackers to exploit the issue by providing a malicious input, leading to denial-of-service through segmentation faults.

The Impact of CVE-2019-7153

Attackers can exploit this vulnerability to cause segmentation faults, resulting in denial-of-service.

Technical Details of CVE-2019-7153

Binaryen 1.38.22 is susceptible to a NULL pointer dereference vulnerability in the function wasm::WasmBinaryBuilder::processFunctions() in wasm/wasm-binary.cpp.

Vulnerability Description

The vulnerability arises when calling wasm::WasmBinaryBuilder::getFunctionIndexName, allowing attackers to craft inputs that lead to segmentation faults and denial-of-service.

Affected Systems and Versions

Product: n/a
Vendor: n/a
Version: n/a

Exploitation Mechanism

Attackers exploit the vulnerability by providing carefully crafted inputs to trigger segmentation faults.

Mitigation and Prevention

Binaryen users should take immediate steps to mitigate the CVE-2019-7153 vulnerability.

Immediate Steps to Take

Update Binaryen to a patched version that addresses the NULL pointer dereference issue.
Implement input validation to prevent malicious inputs.

Long-Term Security Practices

Regularly update software and libraries to the latest versions.
Conduct security audits and code reviews to identify and address vulnerabilities.

Patching and Updates

Apply patches provided by Binaryen promptly to fix the vulnerability and enhance system security.