WebAssembly Micro Runtime Memory Management Vulnerability in LLVM-JIT Mode

A vulnerability exists in WebAssembly Micro Runtime (WAMR) versions prior to 2.4.2, specifically in LLVM-JIT mode. The issue arises when executing WebAssembly programs that include a memory.fill instruction with a memory address pointer of 2 GiB or more. In this scenario, the runtime fails to exit properly, causing a hang in release builds or a crash in debug builds due to invalid pointer access. This problem does not occur in FAST-JIT mode or with other runtime tools.

Impact

The vulnerability leads to a hang in release builds or a crash in debug builds, caused by accessing an invalid pointer.

Reproduction

To reproduce this vulnerability, create a WebAssembly module that includes a memory.fill instruction. Set the first operand, which specifies the memory address pointer, to a value greater than or equal to 2 GiB. When this WebAssembly program is executed in WAMR's LLVM-JIT mode, the runtime will hang or crash, demonstrating the vulnerability.

Remediation

Users can upgrade to WAMR version 2.4.2 or later, where this vulnerability has been fixed.