Critical Null-Dereference Vulnerability in WAMR Package
Summary
OSV-2026-150: Null-dereference READ in wasm_runtime_invoke_native. Affects wamr versions >= 9a23968fdacc0df4ec7066bc19a412f8b7a8bd69, < 9d1dc3e4d26fb50657bc5161d4aa5e2d06f7657d. Fixed in 9d1dc3e4d26fb50657bc5161d4aa5e2d06f7657d. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
WAMR (WebAssembly Micro Runtime) is a lightweight runtime designed for executing WebAssembly applications in various environments, including IoT devices and embedded systems. It provides a compact and efficient way to run WebAssembly code, making it suitable for resource-constrained environments. However, like any software, it is susceptible to vulnerabilities that can compromise its functionality and security.
Vulnerability Detail
The vulnerability identified is a null-dereference read in the function 'wasm_runtime_invoke_native'. This issue arises when the code attempts to access a null pointer, leading to potential crashes and undefined behavior. The origin of this vulnerability was reported through OSS-Fuzz, indicating that it can be exploited under certain conditions, potentially allowing an attacker to disrupt the execution of WebAssembly applications. The crash state indicates that the issue occurs during the invocation of native functions, which could lead to severe ramifications in production environments.
How To Fix
Minimum fixed version
9d1dc3e4d26fb50657bc5161d4aa5e2d06f7657d
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement checks to ensure that pointers are not null before invoking native functions. This can be done by adding conditional statements in the code to validate pointer integrity before usage. For example:
if (pointer != NULL) {
wasm_runtime_invoke_native(pointer);
} else {
// Handle null pointer case
}
This will help prevent crashes until the package can be updated.
Conclusion
The null-dereference vulnerability in the WAMR package poses significant risks to applications utilizing this runtime. It is crucial to address this issue promptly by updating to the patched version and implementing necessary checks in the code. Utilizing tools like Vulert can further enhance your security posture by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for wamr →
FAQ
A null-dereference vulnerability occurs when a program attempts to read or write to a memory location that has not been initialized, leading to crashes or unpredictable behavior.
You can use Vulert, which monitors open-source vulnerabilities in your software. By simply using a manifest file like package-lock.json, Vulert can alert you in real-time. You can also check your application using the Vulert playground without any signup.
Exploiting this vulnerability can lead to application crashes, data corruption, and potential security breaches, especially in production environments.
Yes, a patch has been released in version '9d1dc3e4d26fb50657bc5161d4aa5e2d06f7657d'. It is recommended to update to this version to mitigate the risk.
If an immediate update is not possible, implement null checks in your code to prevent crashes and monitor your application for any unusual behavior.
References
Related vulnerabilities
Recent vulnerabilities recorded for wamr.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
