x/vulndb: potential Go vuln in github.com/CosmWasm/wasmvm/v2: GHSA-23qp-3c2m-xx6w

[GoVulnBot]

Advisory GHSA-23qp-3c2m-xx6w references a vulnerability in the following Go modules:

Module
github.com/CosmWasm/wasmvm
github.com/CosmWasm/wasmvm/v2

Description:

CWA-2025-001

Severity

Medium (Moderate + Likely)[^1]

Affected versions:

• wasmvm >= 2.2.0, < 2.2.2
• wasmvm >= 2.1.0, < 2.1.5
• wasmvm >= 2.0.0, < 2.0.6
• wasmvm < 1.5.8

Patched versions:

• wasmvm 1.5.8, 2.0.6, 2.1.5, 2.2.2

Description of the bug

The vulnerability can be used to crash the chain. The underlying bug that causes this is present on both permissioned and premissionless chains, but it can only be triggered reliably with a malicious contract, so permissioned chains are much less likely to be affected.

(We'll add more detail once chains had a chance to upgr...

References:

• ADVISORY: GHSA-23qp-3c2m-xx6w
• ADVISORY: GHSA-23qp-3c2m-xx6w
• FIX: CosmWasm/wasmvm@0aefa4c
• FIX: CosmWasm/wasmvm@1151bc6
• FIX: CosmWasm/wasmvm@8d44a28
• FIX: CosmWasm/wasmvm@d4ff2ad
• WEB: https://github.com/CosmWasm/advisories/blob/main/CWAs/CWA-2025-001.md

Cross references:

• github.com/CosmWasm/wasmvm appears in 4 other report(s):
  • data/excluded/GO-2024-3060.yaml (x/vulndb: potential Go vuln in github.com/CosmWasm/wasmvm: GHSA-rg2q-2jh9-447q #3060) NOT_GO_CODE
  • data/excluded/GO-2024-3318.yaml (x/vulndb: potential Go vuln in github.com/CosmWasm/wasmvm: GHSA-2q97-m5rc-p3gp #3318) NOT_GO_CODE
  • data/excluded/GO-2024-3320.yaml (x/vulndb: potential Go vuln in github.com/CosmWasm/wasmvm: GHSA-vmqh-5232-v43r #3320) NOT_GO_CODE
  • data/reports/GO-2024-3101.yaml (x/vulndb: potential Go vuln in github.com/CosmWasm/wasmvm: GHSA-75qh-gg76-p2w4 #3101)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/CosmWasm/wasmvm
      versions:
        - fixed: 1.5.8
      vulnerable_at: 1.5.7
    - module: github.com/CosmWasm/wasmvm/v2
      versions:
        - introduced: 2.0.0
        - fixed: 2.0.6
        - introduced: 2.1.0
        - fixed: 2.1.5
        - introduced: 2.2.0
        - fixed: 2.2.2
      vulnerable_at: 2.2.1
summary: 'wasmvm: Malicious smart contract can crash the chain in github.com/CosmWasm/wasmvm'
ghsas:
    - GHSA-23qp-3c2m-xx6w
references:
    - advisory: https://github.com/CosmWasm/wasmvm/security/advisories/GHSA-23qp-3c2m-xx6w
    - advisory: https://github.com/advisories/GHSA-23qp-3c2m-xx6w
    - fix: https://github.com/CosmWasm/wasmvm/commit/0aefa4c378457aeb3c07e7975b875be38872c56d
    - fix: https://github.com/CosmWasm/wasmvm/commit/1151bc6df7d02d1889b8da37cf8510eaf4198eea
    - fix: https://github.com/CosmWasm/wasmvm/commit/8d44a286fabc793a2fba93752e58cd0fd5b88a2d
    - fix: https://github.com/CosmWasm/wasmvm/commit/d4ff2adee44e6b9f7415a5dfbb3de745ab9b7678
    - web: https://github.com/CosmWasm/advisories/blob/main/CWAs/CWA-2025-001.md
source:
    id: GHSA-23qp-3c2m-xx6w
    created: 2025-02-04T19:01:18.699793508Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/647056 mentions this issue: data/reports: add 2 needs review reports