N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-vmg2-r3xv-r3xf

GHSA-vmg2-r3xv-r3xf: Simulation of Wasmd message can cause crashing

CWA-2024-009

Severity

Low (Marginal + Likely)[^1]

Affected versions:

wasmd < 0.53.1

Patched versions:

wasmd 0.53.2 (please note that wasmd 0.53.1 is broken and must not be used)

Description of the bug

(Blank for now. We'll add more detail once chains had a chance to upgrade.)

Mitigations

Apart from upgrading, it is recommended to not open the gRPC and REST APIs of validator nodes to the public internet. Use isolated and resource-constrained environments for running separate public RPC nodes instead. These can then easily be thrown away and replaced with new instances in case of problems.

Applying the patch

Official Wasmd patch

The patch will be shipped in a wasmd release. You will also have to update libwasmvm if you build statically. If you already use the latest / close to latest wasmd, you can update more or less as follows:

Check the current wasmd version: go list -m github.com/CosmWasm/wasmd
Bump the github.com/CosmWasm/wasmd dependency in your go.mod to 0.53.2 (Cosmos SDK 0.50 compatible); go mod tidy; commit.
If you use the static libraries libwasmvm_muslc.aarch64.a/libwasmvm_muslc.x86_64.a, make sure that you use the same version as your wasmvm version.
Check the updated wasmd version: go list -m github.com/CosmWasm/wasmd and ensure you see 0.53.2.
Follow your regular practices to deploy chain upgrades.

To double check if the correct library version is loaded at runtime, use this query: <appd> query wasm libwasmvm-version. It must show 2.1.4.

The patch is not consensus breaking if you are already using wasmvm 2.1.3. If you are instead using wasmvm 2.1.2, then upgrading to 2.1.4 includes the consensus breaking changes of 2.1.3.

Miggo Vulnerability Database

→

GHSA-vmg2-r3xv-r3xf

GHSA-vmg2-r3xv-r3xf:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/CosmWasm/wasmd	go	< 0.53.2	0.53.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability manifests during message simulation and requires updates to both wasmd and libwasmvm. This suggests issues in both the high-level simulation handler (wasmd's message server) and low-level WASM execution (libwasmvm). The SimulateMsg function is the primary entry point for message simulation in Cosmos SDK modules, and improper handling of contract messages here could lead to crashes. The libwasmvm execute() function's involvement is inferred from the required dependency updates and the crash context. Confidence is medium due to limited code details, but the pattern matches simulation-related vulnerabilities in Cosmos ecosystems.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-vmg2-r3xv-r3xf: Simulation of Wasmd message can cause crashing

CWA-2024-009

Description of the bug

Mitigations

Applying the patch

Official Wasmd patch

GHSA-vmg2-r3xv-r3xf:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

N/A

N/A

GHSA-vmg2-r3xv-r3xf: Simulation of Wasmd message can cause crashing

CWA-2024-009

Description of the bug

Mitigations

Applying the patch

Official Wasmd patch

DIY Patch

Acknowledgement

Timeline

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI