Severity
Low (Marginal + Likely)[^1]
Affected versions:
Patched versions:
(Blank for now. We'll add more detail once chains had a chance to upgrade.)
Apart from upgrading, it is recommended to not open the gRPC and REST APIs of validator nodes to the public internet. Use isolated and resource-constrained environments for running separate public RPC nodes instead. These can then easily be thrown away and replaced with new instances in case of problems.
The patch will be shipped in a wasmd release. You will also have to update libwasmvm
if you build statically.
If you already use the latest / close to latest wasmd, you can update more or less as follows:
go list -m github.com/CosmWasm/wasmd
github.com/CosmWasm/wasmd
dependency in your go.mod to 0.53.2 (Cosmos SDK 0.50 compatible); go mod tidy
; commit.libwasmvm_muslc.aarch64.a
/libwasmvm_muslc.x86_64.a
, make sure that you use the same version as your wasmvm version.go list -m github.com/CosmWasm/wasmd
and ensure you see 0.53.2.To double check if the correct library version is loaded at runtime, use this query:
<appd> query wasm libwasmvm-version
. It must show 2.1.4.
The patch is not consensus breaking if you are already using wasmvm 2.1.3. If you are instead using wasmvm 2.1.2, then upgrading to 2.1.4 includes the consensus breaking changes of 2.1.3.
If you are unable to upgrade to the latest version, you can backport the wasmd patch to your version. The patch is available at Wasmd 0.53.2. However, if you are on an older version of wasmd, you will also be using a different version of wasmvm. We provide the required patches for wasmvm in versions 2.1.4, 2.0.5, 1.5.6. To upgrade using this method:
go list -m github.com/CosmWasm/wasmvm
and upgrade
to the closest patched version.libwasmvm_muslc.aarch64.a
/libwasmvm_muslc.x86_64.a
, make sure that you use the same version as your wasmvm version.To double check if the correct library version is loaded at runtime, use this query:
<appd> query wasm libwasmvm-version
. It must show 2.1.4, 2.0.5 or 1.5.6 and must be the same as the wasmvm version in your go.sum.
The patch is not consensus breaking as long as you were using the previous patch version of wasmvm before.
This issue was found by meadow101 who reported it to the Cosmos Bug Bounty Program on HackerOne.
If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.
{ "nvd_published_at": null, "cwe_ids": [], "severity": "LOW", "github_reviewed": true, "github_reviewed_at": "2024-12-10T16:55:35Z" }