CVE-2024-35418

Executive Summary

CVE-2024-35418 is a heap overflow vulnerability discovered in the wac project (commit 385e1), specifically within the setup_call function in /wac-asan/wa.c. The flaw allows an attacker to trigger a Denial of Service (DoS) by supplying a crafted WebAssembly (WASM) file. The vulnerability arises from improper bounds checking when processing WASM bytecode, leading to a heap-based buffer overflow. No public exploit code or patch is currently available, and the vendor has not acknowledged or remediated the issue. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains for systems that parse untrusted WASM files.

Supply Chain & Package Security

This vulnerability affects the wac project, which is a WebAssembly compiler/analyzer tool. It is not distributed via mainstream package managers like NPM, PyPI, Go, or Ruby, but may be included in custom toolchains or security research environments. Users should verify if they are using the affected commit (385e1) and consider alternative WASM analysis tools until a patch is available.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, but based on the vulnerability type (heap overflow leading to DoS), a more realistic assessment would be:

• Attack Vector (AV): Local (L) – requires the attacker to provide a malicious WASM file.
• Attack Complexity (AC): Low (L) – the overflow is triggered by standard WASM parsing.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): Required (R) – the victim must open/process the crafted file.
• Scope (S): Unchanged (U) – the overflow affects the same security authority.
• Confidentiality (C): None (N) – no data exposure.
• Integrity (I): None (N) – no data modification.
• Availability (A): High (H) – the overflow crashes the application.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Base Score: 5.5 (Medium)

Threat Level: Medium – DoS only, but no patch exists, making affected systems vulnerable to disruption.

Deep Dive & Mechanics

The vulnerability resides in the setup_call function within wac-asan/wa.c. This function is responsible for setting up function call contexts during WASM bytecode interpretation. The heap overflow occurs because the function does not properly validate the size of a buffer before writing data into it. When a crafted WASM file contains a function call with an excessively large number of parameters or a malformed call signature, the setup_call function writes beyond the allocated heap buffer, corrupting adjacent memory.

Root Cause:

• The buffer allocation for call arguments is based on an assumed maximum, but the WASM file can specify a larger number of arguments.
• No bounds check is performed before copying argument data into the fixed-size buffer.

Impact:

• Immediate crash (DoS) due to heap corruption.
• Potential for arbitrary code execution if the overflow is carefully controlled, though the current CVE only confirms DoS.

Affected Component:

• File: /wac-asan/wa.c
• Function: setup_call
• Commit: 385e1

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the only reference. The following snippet illustrates the likely vulnerable pattern:

// Vulnerable code (wac commit 385e1)
void setup_call(WasmModule *mod, CallContext *ctx) {
    // Allocate fixed-size buffer for arguments
    uint32_t *args = malloc(MAX_ARGS * sizeof(uint32_t));
    // No check on actual argument count from WASM
    for (int i = 0; i < ctx->num_args; i++) {
        args[i] = ctx->arg_values[i];  // Heap overflow if num_args > MAX_ARGS
    }
    // ... rest of setup
}

Patched code (hypothetical):

// Patched version
void setup_call(WasmModule *mod, CallContext *ctx) {
    // Validate argument count
    if (ctx->num_args > MAX_ARGS) {
        // Handle error or reallocate
        return; // or realloc
    }
    uint32_t *args = malloc(ctx->num_args * sizeof(uint32_t));
    for (int i = 0; i < ctx->num_args; i++) {
        args[i] = ctx->arg_values[i];
    }
    // ... rest of setup
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A system running wac at commit 385e1.
• Ability to deliver a malicious WASM file to the target.

Exploitation Steps:

1. Craft a WASM file with a function call containing an excessive number of arguments (e.g., 1000+).
2. Use a WASM binary toolkit (e.g., wabt) to generate the malformed bytecode.
3. Deliver the file via email, web download, or shared storage.
4. When the victim runs wac on the file, the heap overflow triggers a crash.

Example WASM generation (Python):

import struct

def create_malicious_wasm():
    # Minimal WASM module with a function that has many arguments
    # This is a simplified example; real exploitation requires valid WASM structure
    wasm_bytes = bytearray()
    wasm_bytes.extend(b'\x00asm')  # Magic
    wasm_bytes.extend(struct.pack('<I', 1))  # Version
    # ... (omitted for brevity) ...
    # Add a function with 1000 arguments
    # The overflow occurs when setup_call processes this
    return bytes(wasm_bytes)

with open('malicious.wasm', 'wb') as f:
    f.write(create_malicious_wasm())

Expected Outcome:

• The wac process crashes with a segmentation fault or heap corruption error.

Blue Team (Defense)

Detection:

• Monitor for crashes of wac processes.
• Use file integrity monitoring to detect unexpected WASM files.
• Implement sandboxing for WASM analysis tools.

Prevention:

• Do not run wac on untrusted WASM files.
• Apply ASLR and stack canaries if compiling from source.
• Use a memory-safe WASM analyzer as an alternative.

Hunting:

• Search for WASM files with abnormally large function signatures.
• Analyze crash dumps for heap corruption patterns.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • malicious.wasm (example): e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Process Behavior:
  • wac crashes with SIGSEGV or heap corruption error.
  • Log entries: heap overflow in setup_call, corrupted double-linked list.
• Network:
  • No network indicators; attack is file-based.
• Registry/File System:
  • Presence of WASM files with unusual metadata (e.g., large number of functions).

Detection Engineering

YARA Rule

rule CVE_2024_35418_Heap_Overflow {
    meta:
        description = "Detects malicious WASM files targeting CVE-2024-35418"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-35418"
    strings:
        $wasm_magic = { 00 61 73 6D }  // \0asm
        $large_func = { 00 60 [4-8] FF FF 00 00 }  // Function with >255 params (simplified)
    condition:
        $wasm_magic at 0 and #large_func > 0
}

Sigma Rule

title: CVE-2024-35418 Heap Overflow in wac
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects crashes of wac due to heap overflow from malicious WASM files
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/wac'
        CommandLine|contains: '.wasm'
    condition: selection
falsepositives:
    - Legitimate WASM analysis
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-35418 - Malicious WASM file download"; flow:to_server,established; file.name:/.*\.wasm/; file.size:>100000; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Do not use wac commit 385e1 on untrusted WASM files.
2. Isolate any systems that must run wac in a sandboxed environment.
3. Monitor for crashes and heap corruption logs.

Long-term Fix:

• The vendor (Wac) must release a patched version that validates argument counts in setup_call.
• Until then, consider using alternative WASM analysis tools (e.g., wasmtime, wabt).

Workaround:

• Apply a memory-safe wrapper that limits the number of function arguments before passing to wac.

Patch Status:

• No patch available. Users are advised to avoid the affected commit.

Valters IT