x/vulndb: potential Go vuln in github.com/CosmWasm/wasmvm: GHSA-rg2q-2jh9-447q

[GoVulnBot]

Advisory GHSA-rg2q-2jh9-447q references a vulnerability in the following Go modules:

Module
github.com/CosmWasm/wasmvm
github.com/CosmWasm/wasmvm/v2

Description:
Component: wasmvm
Criticality: Medium (ACMv1: I:Moderate; L:Likely)
Patched versions: wasmvm 1.5.3, 2.0.2, 2.1.1

Some Wasm operations take significantly more gas than our benchmarks indicated. This can lead to missing the gas target we defined by a factor of ~10x. This means a malicious contract could take 10 times as much time to execute as expected, which can be used to temp...

References:

• ADVISORY: GHSA-rg2q-2jh9-447q
• ADVISORY: GHSA-rg2q-2jh9-447q
• FIX: CosmWasm/cosmwasm@5bef1c5
• FIX: CosmWasm/cosmwasm@9b4d6d0
• FIX: CosmWasm/cosmwasm@c1313af
• WEB: https://github.com/CosmWasm/advisories/blob/main/CWAs/CWA-2024-004.md
• WEB: https://rustsec.org/advisories/RUSTSEC-2024-0361.html

No existing reports found with this module or alias.
See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/CosmWasm/wasmvm
      versions:
        - fixed: 1.5.3
      vulnerable_at: 1.5.2
    - module: github.com/CosmWasm/wasmvm/v2
      versions:
        - introduced: 2.0.0
        - fixed: 2.0.2
        - introduced: 2.1.0
        - fixed: 2.1.1
      vulnerable_at: 2.1.0
summary: Gas mispricing in cosmwasm-vm in github.com/CosmWasm/wasmvm
ghsas:
    - GHSA-rg2q-2jh9-447q
references:
    - advisory: https://github.com/CosmWasm/wasmvm/security/advisories/GHSA-rg2q-2jh9-447q
    - advisory: https://github.com/advisories/GHSA-rg2q-2jh9-447q
    - fix: https://github.com/CosmWasm/cosmwasm/commit/5bef1c588933bd60a04bb70099150cf84b69e144
    - fix: https://github.com/CosmWasm/cosmwasm/commit/9b4d6d03772b75d500a7d3c972d0d8ba6d085c06
    - fix: https://github.com/CosmWasm/cosmwasm/commit/c1313afeb261e17b1c8cf6a1eacee1da0dac42ae
    - web: https://github.com/CosmWasm/advisories/blob/main/CWAs/CWA-2024-004.md
    - web: https://rustsec.org/advisories/RUSTSEC-2024-0361.html
source:
    id: GHSA-rg2q-2jh9-447q
    created: 2024-08-08T17:01:19.664344005Z
review_status: UNREVIEWED

[tatianab]

All fix commits reference Rust code.

[gopherbot]

Change https://go.dev/cl/606776 mentions this issue: data/excluded: add 2 excluded reports