5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-29942

CVE-2023-29942: llvm-project commit a0138390 was discovered to contain a segmentation fault via the component...

llvm-project commit a0138390 was discovered to contain a segmentation fault via the component mlir::Type::isa<mlir::LLVM::LLVMVoidType.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-29942

CVE-2023-29942:

5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis is based on the vulnerability description for CVE-2023-29942 and the detailed stack trace provided in the associated GitHub issue #59990. The commit a0138390 is identified as the specific version of the llvm-project codebase where this MLIR segmentation fault was discovered, not as a patch that introduces or fixes this particular MLIR vulnerability (its diffs pertain to an unrelated Clang issue). The vulnerable functions are those directly involved in the crash sequence as shown in the stack trace. mlir::Type::isa<...>() const is where the crash occurs, and mlir::LLVM::LLVMStructType::verify is a key caller that processes the input leading to the vulnerable path in isa.

The commit a0138390dd2ac2130c9f76e6778d6e45e4dc5526 mentioned in the vulnerability description and the issue is the state of the code where the vulnerability was found, not a patch for the vulnerability. The changes in this specific commit are related to Clang's constant expression evaluation and are not directly related to the MLIR segmentation fault. The evidence for the vulnerable MLIR functions comes from the stack trace in issue #59990, which points to mlir::Type::isa as the crashing function and mlir::LLVM::LLVMStructType::verify as a caller in the vulnerable path. The file paths are educated guesses based on typical LLVM/MLIR project structure, as they are not explicitly in the stack trace but are standard locations for these types of functions. The function signatures are taken directly from the stack trace for accuracy in runtime profiling scenarios.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.