GHSA-rg2q-2jh9-447q RUSTSEC-2024-0361

Gas mispricing in cosmwasm-vm

Medium Gocrates.io

Severity: 0.0 / 10; Medium · CVSS 4.0
Exploit chance (EPSS): —; No score published
Known exploited: No; Not in CISA's catalog
Weakness: CWE-920 Improper Restriction of Power Consumption
Fix: Available; 3 packages have a fixed version

Description

Component: wasmvm Criticality: Medium (ACMv1: I:Moderate; L:Likely) Patched versions: wasmvm 1.5.4, 2.0.3, 2.1.2

Some Wasm operations take significantly more gas than our benchmarks indicated. This can lead to missing the gas target we defined by a factor of ~10x. This means a malicious contract could take 10 times as much time to execute as expected, which can be used to temporarily DoS a chain.

See CWA-2024-004 for more details.

Affected versions

Go

Package	Vulnerable	Fixed in
github.com/CosmWasm/wasmvm	`< 1.5.4`	`1.5.4`
github.com/CosmWasm/wasmvm/v2	`>= 2.1.0, < 2.1.2`	`2.1.2`
github.com/CosmWasm/wasmvm/v2	`>= 2.0.0, < 2.0.3`	`2.0.3`

crates.io

Package	Vulnerable	Fixed in
cosmwasm-vm	`< 1.5.6`	`1.5.6`
cosmwasm-vm	`>= 2.0.0, < 2.0.5`	`2.0.5`
cosmwasm-vm	`>= 2.1.0, < 2.1.2`	`2.1.2`
cosmwasm-vm	`>= 0.0.0-0, < 1.5.7` `>= 2.0.0, < 2.0.6` `>= 2.1.0, < 2.1.3`	`1.5.7` `2.0.6` `2.1.3`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

github.com/CosmWasm/wasmvm Go → `1.5.4`

go

go get github.com/CosmWasm/wasmvm@v1.5.4 && go mod tidy

github.com/CosmWasm/wasmvm/v2 Go → `2.1.2`

go

go get github.com/CosmWasm/wasmvm/v2@v2.1.2 && go mod tidy

cosmwasm-vm crates.io → `1.5.6`

cargo

cargo update -p cosmwasm-vm --precise 1.5.6

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: Low
User interaction: None
Confidentiality (vulnerable system): None
Integrity (vulnerable system): None
Availability (vulnerable system): Low
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None

CVSS 3.1 4.3

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: Low

Weakness

CWE-920: Improper Restriction of Power Consumption

The product operates in an environment in which power is a limited resource that cannot be automatically replenished, but the product does not properly restrict the amount of power that its operation consumes.

References

Packages

Timeline

Aug 8, 2024 Published
Aug 8, 2024 Last updated by the source

Advisory	Severity	Why it's related
GHSA-mx2j-7cmv-353c wasmvm: Malicious smart contract can slow down block production	Medium	Also affects cosmwasm-vm
GHSA-2q97-m5rc-p3gp CosmWasm VM Incorrect metering	Medium	Also affects cosmwasm-vm
GHSA-vmqh-5232-v43r Panic in wasmvm can slow down block production	Medium	Also affects cosmwasm-vm
GHSA-75qh-gg76-p2w4 CWA-2023-004: Excessive number of function parameters in compiled Wasm	Medium	Also affects cosmwasm-vm

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor