GHSA-2pgj-5cv2-6xxw: FuelVM is vulnerable to heap memory allocation re-use bug
N/A
Basic Information
RustTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| fuel-vm | rust | < 0.59.3 | 0.59.3 |
| fuel-vm | rust | >= 0.60.0, < 0.60.1 | 0.60.1 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The analysis of the provided security advisory and the associated commit 9c97c2bf782626b35ba48e154f210f91c847a513 points to a 'Use After Free' vulnerability in the FuelVM's memory management. The vulnerability description explicitly states that memory deallocated by ret is not cleared, allowing subsequent memory accesses (mload) to read stale data. The patch is located in fuel-vm/src/interpreter/memory.rs, within the MemoryInstance implementation. The changes introduce code to explicitly zero out the heap (self.heap[..end].fill(0);) before a reallocation occurs. The accompanying test file, allocation_tests.rs, adds tests named memory_instance__grow_heap_by_after_reset__does_not_retain_dirty_memory_size, which confirms that the function being fixed is grow_heap_by. This function is responsible for expanding the heap, and the vulnerability manifests when it reallocates memory without sanitizing the old content. Therefore, fuel_vm::interpreter::memory::MemoryInstance::grow_heap_by is the precise vulnerable function that would appear in a runtime profile during exploitation, as it's the function that fails to enforce memory isolation during heap growth operations.
Vulnerable functions
fuel_vm::interpreter::memory::MemoryInstance::grow_heap_byfuel-vm/src/interpreter/memory.rs