NULL Pointer Dereference in Binaryen 1.38.32
Summary
CVE-2019-15759: An issue was discovered in Binaryen 1.38.32. Affects binaryen across 2 version ranges.
< 89-1
< e2f49d8227f2b71e4dede5cf4074bb9f65e3d77f
Fixed in 89-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Binaryen is an open-source compiler and toolchain infrastructure library for WebAssembly. It provides a set of tools for generating, optimizing, and manipulating WebAssembly code. The library is widely used in various projects and ecosystems, including Debian. However, a vulnerability has been discovered in Binaryen version 1.38.32 that can lead to a NULL pointer dereference in the 'wasm::LocalSet::finalize' function. This vulnerability can be triggered by a crafted input and may result in segmentation faults, leading to denial-of-service attacks.
Vulnerability Detail
The vulnerability exists in the 'ir/ExpressionManipulator.cpp' file of Binaryen. Two visitors in this file can cause a NULL pointer dereference in the 'wasm::LocalSet::finalize' function in 'wasm/wasm.cpp'. An attacker can exploit this vulnerability by providing a specially crafted input, which can lead to segmentation faults and denial-of-service attacks. The vulnerability has been assigned the CVE identifier CVE-2019-15759 and has a CVSS score of 6.5.
How To Fix
Minimum fixed version
89-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade binaryenTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can apply input validation to prevent the execution of crafted inputs that trigger the vulnerability. By validating the input and ensuring it adheres to the expected format, the risk of exploitation can be mitigated. Here is an example of input validation code in C++:
void validateInput(const std::string& input) {
// Perform input validation checks
// If the input is not valid, handle the error appropriately
}
Conclusion
In conclusion, a vulnerability has been discovered in Binaryen version 1.38.32 that can lead to a NULL pointer dereference. This vulnerability can be exploited by providing a crafted input, resulting in segmentation faults and denial-of-service attacks. It is recommended to update Binaryen to a version that includes the fix for this vulnerability. Input validation can also be applied as a workaround to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for binaryen →
FAQ
Binaryen is an open-source compiler and toolchain infrastructure library for WebAssembly. It provides tools for generating, optimizing, and manipulating WebAssembly code.
This vulnerability can lead to denial-of-service attacks by causing segmentation faults in applications that use Binaryen. An attacker can exploit this vulnerability by providing a specially crafted input.
To fix this vulnerability, update Binaryen to a version that includes the fix. Pull the latest changes from the official GitHub repository and rebuild the library.
Yes, you can apply input validation to prevent the execution of crafted inputs that trigger the vulnerability. Validate the input and ensure it adheres to the expected format.
The CVSS score of this vulnerability is 6.5, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for binaryen.
