GHSA-mx2j-7cmv-353c

Source

https://github.com/advisories/GHSA-mx2j-7cmv-353c

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-mx2j-7cmv-353c/GHSA-mx2j-7cmv-353c.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-mx2j-7cmv-353c

Aliases

GO-2025-3449

Published

2025-02-04T18:57:21Z

Modified

2025-07-09T16:06:08Z

Summary

wasmvm: Malicious smart contract can slow down block production

Details

CWA-2025-002

Severity

Medium (Moderate + Likely)[^1]

Affected versions:

wasmvm >= 2.2.0, < 2.2.2
wasmvm >= 2.1.0, < 2.1.5
wasmvm >= 2.0.0, < 2.0.6
wasmvm < 1.5.8

Patched versions:

wasmvm 1.5.8, 2.0.6, 2.1.5, 2.2.2

Description of the bug

The vulnerability can be used to slow down block production. The attack requires a malicious contract, so permissioned chains are unlikely to be affected.

(We'll add more detail once chains had a chance to upgrade.)

Patch

Applying the patch

The patch will be shipped in releases of wasmvm. You can update more or less as follows:

Check the current wasmvm version: go list -m github.com/CosmWasm/wasmvm
Bump the github.com/CosmWasm/wasmvm dependency in your go.mod to one of the patched version depending on which minor version you are on; go mod tidy; commit.
If you use the static libraries libwasmvm_muslc.aarch64.a/libwasmvm_muslc.x86_64.a, update them accordingly.
Check the updated wasmvm version: go list -m github.com/CosmWasm/wasmvm and ensure you see 1.5.8, 2.0.6, 2.1.5 or 2.2.2.
Follow your regular practices to deploy chain upgrades.

The patch is consensus breaking and requires a coordinated upgrade.

Acknowledgement

This issue was found by meadow101 who reported it to the Cosmos Bug Bounty Program on HackerOne.

If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.

Timeline

2024-11-24: Confio receives a report through the Cosmos bug bounty program maintained by Amulet.
2024-12-20: Confio security contributors confirm the report.
2024-01-27: Confio developed the patch internally.
2025-02-04: Patch gets released.

[^1]: following Amulet's Severity Classification Framework ACMv1.2: https://github.com/interchainio/security/blob/0295254e8645301ccb606d46108a45cede0a73e0/resources/CLASSIFICATION_MATRIX.md

Database specific

{
    "cwe_ids": [],
    "github_reviewed": true,
    "github_reviewed_at": "2025-02-04T18:57:21Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
}

References

Affected packages

crates.io

cosmwasm-vm

Package

Name: cosmwasm-vm; View open source insights on deps.dev
Purl: pkg:cargo/cosmwasm-vm

Affected ranges

Type: SEMVER
Events: Introduced

2.2.0

Fixed

2.2.1

Affected versions

2.*

2.2.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-mx2j-7cmv-353c/GHSA-mx2j-7cmv-353c.json"

cosmwasm-vm

Package

Name: cosmwasm-vm; View open source insights on deps.dev
Purl: pkg:cargo/cosmwasm-vm

Affected ranges

Type: SEMVER
Events: Introduced

2.1.0

Fixed

2.1.6

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-mx2j-7cmv-353c/GHSA-mx2j-7cmv-353c.json"

cosmwasm-vm

Package

Name: cosmwasm-vm; View open source insights on deps.dev
Purl: pkg:cargo/cosmwasm-vm

Affected ranges

Type: SEMVER
Events: Introduced

2.0.0

Fixed

2.0.9

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-mx2j-7cmv-353c/GHSA-mx2j-7cmv-353c.json"

cosmwasm-vm

Package

Name: cosmwasm-vm; View open source insights on deps.dev
Purl: pkg:cargo/cosmwasm-vm

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.5.10

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-mx2j-7cmv-353c/GHSA-mx2j-7cmv-353c.json"

github.com/CosmWasm/wasmvm

Package

Name: github.com/CosmWasm/wasmvm; View open source insights on deps.dev
Purl: pkg:golang/github.com/CosmWasm/wasmvm

Affected ranges

Type: SEMVER
Events: Introduced

0.1.0

Fixed

1.5.8

Database specific

last_known_affected_version_range

"<= 1.5.7"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-mx2j-7cmv-353c/GHSA-mx2j-7cmv-353c.json"

github.com/CosmWasm/wasmvm/v2

Package

Name: github.com/CosmWasm/wasmvm/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/CosmWasm/wasmvm/v2

Affected ranges

Type: SEMVER
Events: Introduced

2.2.0

Fixed

2.2.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-mx2j-7cmv-353c/GHSA-mx2j-7cmv-353c.json"

github.com/CosmWasm/wasmvm/v2

Package

Name: github.com/CosmWasm/wasmvm/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/CosmWasm/wasmvm/v2

Affected ranges

Type: SEMVER
Events: Introduced

2.1.0

Fixed

2.1.5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-mx2j-7cmv-353c/GHSA-mx2j-7cmv-353c.json"

github.com/CosmWasm/wasmvm/v2

Package

Name: github.com/CosmWasm/wasmvm/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/CosmWasm/wasmvm/v2

Affected ranges

Type: SEMVER
Events: Introduced

2.0.0

Fixed

2.0.6

Database specific

last_known_affected_version_range

"<= 2.0.5"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-mx2j-7cmv-353c/GHSA-mx2j-7cmv-353c.json"

github.com/CosmWasm/wasmvm

Package

Name: github.com/CosmWasm/wasmvm; View open source insights on deps.dev
Purl: pkg:golang/github.com/CosmWasm/wasmvm

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.0.0-20250204093451-1f4db20199b8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-mx2j-7cmv-353c/GHSA-mx2j-7cmv-353c.json"

github.com/CosmWasm/wasmvm/v2

Package

Name: github.com/CosmWasm/wasmvm/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/CosmWasm/wasmvm/v2

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.0.0-20250204103256-d62c3b826a9d

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-mx2j-7cmv-353c/GHSA-mx2j-7cmv-353c.json"

github.com/CosmWasm/wasmvm

Package

Name: github.com/CosmWasm/wasmvm; View open source insights on deps.dev
Purl: pkg:golang/github.com/CosmWasm/wasmvm

Affected ranges

Type: SEMVER
Events: Introduced

1.5.8-0

Fixed

1.5.8-0.20250204093451-1f4db20199b8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-mx2j-7cmv-353c/GHSA-mx2j-7cmv-353c.json"

github.com/CosmWasm/wasmvm/v2

Package

Name: github.com/CosmWasm/wasmvm/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/CosmWasm/wasmvm/v2

Affected ranges

Type: SEMVER
Events: Introduced

2.0.6-0

Fixed

2.0.6-0.20250204103256-d62c3b826a9d

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-mx2j-7cmv-353c/GHSA-mx2j-7cmv-353c.json"