{"id":"GHSA-2q97-m5rc-p3gp","aliases":[],"status":"published","title":"CosmWasm VM Incorrect metering","description":"# CWA-2024-007\n\n**Severity**\n\nMedium (Moderate + Likely)[^1]\n\n**Affected versions:**\n\n- wasmvm \u003e= 2.1.0, \u003c 2.1.3\n- wasmvm \u003e= 2.0.0, \u003c 2.0.4\n- wasmvm \u003c 1.5.5\n- cosmwasm-vm \u003e= 2.1.0, \u003c 2.1.4\n- cosmwasm-vm \u003e= 2.0.0, \u003c 2.0.7\n- cosmwasm-vm \u003c 1.5.8\n\n**Patched versions:**\n\n- wasmvm 1.5.5, 2.0.4, 2.1.3\n- cosmwasm-vm 1.5.8, 2.0.7, 2.1.4\n\n## Description of the bug\n\n(Blank for now. We'll add more detail once chains had a chance to upgrade.)\n\n## Patch\n\n- 1.5: https://github.com/CosmWasm/cosmwasm/commit/16eabd681790508b13dac8e67f9e6e61045240ea\n- 2.0: https://github.com/CosmWasm/cosmwasm/commit/0e70bd83119b02f99a2c0397f0913e0803750fd9\n- 2.1: https://github.com/CosmWasm/cosmwasm/commit/f5bf24f3acadca2892afd58cc3ce5fdeb932d492\n\n## Applying the patch\n\nThe patch will be shipped in releases of wasmvm. You can update more or less as follows:\n\n1. Check the current wasmvm version: `go list -m github.com/CosmWasm/wasmvm`\n2. Bump the `github.com/CosmWasm/wasmvm` dependency in your go.mod to 1.5.5, 2.0.4, 2.1.3 depending on which minor version you are; `go mod tidy`; commit.\n3. If you use the static libraries `libwasmvm_muslc.aarch64.a`/`libwasmvm_muslc.x86_64.a`, update them accordingly.\n4. Check the updated wasmvm version: `go list -m github.com/CosmWasm/wasmvm` and ensure you see 1.5.5, 2.0.4, 2.1.3.\n5. Follow your regular practices to deploy chain upgrades.\n\nTo double check if the correct library version is loaded at runtime, use this query:\n`\u003cappd\u003e query wasm libwasmvm-version`. It must show 1.5.5, 2.0.4 or 2.1.3.\n\nThe patch is consensus breaking and requires a coordinated upgrade.\n\n## Acknowledgement\n\nThis issue was found by meadow101 who reported it to the Cosmos Bug Bounty Program on HackerOne.\n\nIf you believe you have found a bug in the Interchain Stack or would like to contribute to the\nprogram by reporting a bug, please see \u003chttps://hackerone.com/cosmos\u003e.\n\n## Timeline\n\n- 2024-08-28: Confio receives a report through the Cosmos bug bounty program maintained by Amulet.\n- 2024-08-30: Confio security contributors confirm the report.\n- 2024-09-02: Confio developed the patch internally.\n- 2024-09-23: Patch is released.\n\n[^1]: following Amulet's Severity Classification Framework ACMv1: https://github.com/interchainio/security/blob/e0227a1fb4059144aab4f6003eeee7f09912db3a/resources/CLASSIFICATION_MATRIX.md","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2024-12-10T16:55:39Z","modified":"2024-12-10T16:55:41Z","fixes":[{"ecosystem":"Go","package":"github.com/CosmWasm/wasmvm/v2","fixed_in":["2.1.3","2.0.4"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/CosmWasm/wasmvm","fixed_in":["1.5.5"],"sources":["ghsa","osv"]},{"ecosystem":"crates.io","package":"cosmwasm-vm","fixed_in":["2.1.4","2.0.7","1.5.8"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/CosmWasm/wasmvm/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.3"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/CosmWasm/wasmvm/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.4"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/CosmWasm/wasmvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.5"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"cosmwasm-vm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.4"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"cosmwasm-vm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.7"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"cosmwasm-vm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.8"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/CosmWasm/wasmvm/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.1.0"},{"fixed":"2.1.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/CosmWasm/wasmvm/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.0.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/CosmWasm/wasmvm","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.5.5"}]}]},{"source":"osv","ecosystem":"crates.io","package":"cosmwasm-vm","ranges":[{"type":"SEMVER","events":[{"introduced":"2.1.0"},{"fixed":"2.1.4"}]}]},{"source":"osv","ecosystem":"crates.io","package":"cosmwasm-vm","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.0.7"}]}]},{"source":"osv","ecosystem":"crates.io","package":"cosmwasm-vm","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.5.8"}]}]}],"references":[{"url":"https://github.com/CosmWasm/wasmvm/security/advisories/GHSA-2q97-m5rc-p3gp","tags":["web"]},{"url":"https://github.com/CosmWasm/cosmwasm/commit/0e70bd83119b02f99a2c0397f0913e0803750fd9","tags":["web"]},{"url":"https://github.com/CosmWasm/cosmwasm/commit/16eabd681790508b13dac8e67f9e6e61045240ea","tags":["web"]},{"url":"https://github.com/CosmWasm/cosmwasm/commit/f5bf24f3acadca2892afd58cc3ce5fdeb932d492","tags":["web"]},{"url":"https://github.com/CosmWasm/advisories/blob/main/CWAs/CWA-2024-007.md","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2q97-m5rc-p3gp"},{"url":"https://github.com/CosmWasm/wasmvm","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-2q97-m5rc-p3gp","title":"CosmWasm VM Incorrect metering","description":"# CWA-2024-007\n\n**Severity**\n\nMedium (Moderate + Likely)[^1]\n\n**Affected versions:**\n\n- wasmvm \u003e= 2.1.0, \u003c 2.1.3\n- wasmvm \u003e= 2.0.0, \u003c 2.0.4\n- wasmvm \u003c 1.5.5\n- cosmwasm-vm \u003e= 2.1.0, \u003c 2.1.4\n- cosmwasm-vm \u003e= 2.0.0, \u003c 2.0.7\n- cosmwasm-vm \u003c 1.5.8\n\n**Patched versions:**\n\n- wasmvm 1.5.5, 2.0.4, 2.1.3\n- cosmwasm-vm 1.5.8, 2.0.7, 2.1.4\n\n## Description of the bug\n\n(Blank for now. We'll add more detail once chains had a chance to upgrade.)\n\n## Patch\n\n- 1.5: https://github.com/CosmWasm/cosmwasm/commit/16eabd681790508b13dac8e67f9e6e61045240ea\n- 2.0: https://github.com/CosmWasm/cosmwasm/commit/0e70bd83119b02f99a2c0397f0913e0803750fd9\n- 2.1: https://github.com/CosmWasm/cosmwasm/commit/f5bf24f3acadca2892afd58cc3ce5fdeb932d492\n\n## Applying the patch\n\nThe patch will be shipped in releases of wasmvm. You can update more or less as follows:\n\n1. Check the current wasmvm version: `go list -m github.com/CosmWasm/wasmvm`\n2. Bump the `github.com/CosmWasm/wasmvm` dependency in your go.mod to 1.5.5, 2.0.4, 2.1.3 depending on which minor version you are; `go mod tidy`; commit.\n3. If you use the static libraries `libwasmvm_muslc.aarch64.a`/`libwasmvm_muslc.x86_64.a`, update them accordingly.\n4. Check the updated wasmvm version: `go list -m github.com/CosmWasm/wasmvm` and ensure you see 1.5.5, 2.0.4, 2.1.3.\n5. Follow your regular practices to deploy chain upgrades.\n\nTo double check if the correct library version is loaded at runtime, use this query:\n`\u003cappd\u003e query wasm libwasmvm-version`. It must show 1.5.5, 2.0.4 or 2.1.3.\n\nThe patch is consensus breaking and requires a coordinated upgrade.\n\n## Acknowledgement\n\nThis issue was found by meadow101 who reported it to the Cosmos Bug Bounty Program on HackerOne.\n\nIf you believe you have found a bug in the Interchain Stack or would like to contribute to the\nprogram by reporting a bug, please see \u003chttps://hackerone.com/cosmos\u003e.\n\n## Timeline\n\n- 2024-08-28: Confio receives a report through the Cosmos bug bounty program maintained by Amulet.\n- 2024-08-30: Confio security contributors confirm the report.\n- 2024-09-02: Confio developed the patch internally.\n- 2024-09-23: Patch is released.\n\n[^1]: following Amulet's Severity Classification Framework ACMv1: https://github.com/interchainio/security/blob/e0227a1fb4059144aab4f6003eeee7f09912db3a/resources/CLASSIFICATION_MATRIX.md","status":"published","published":"2024-12-10T16:55:39Z","modified":"2024-12-10T16:55:41Z","updated_at":"2026-11-02T14:38:24.542211Z"}],"osv":[{"id":"GHSA-2q97-m5rc-p3gp","title":"CosmWasm VM Incorrect metering","description":"# CWA-2024-007\n\n**Severity**\n\nMedium (Moderate + Likely)[^1]\n\n**Affected versions:**\n\n- wasmvm \u003e= 2.1.0, \u003c 2.1.3\n- wasmvm \u003e= 2.0.0, \u003c 2.0.4\n- wasmvm \u003c 1.5.5\n- cosmwasm-vm \u003e= 2.1.0, \u003c 2.1.4\n- cosmwasm-vm \u003e= 2.0.0, \u003c 2.0.7\n- cosmwasm-vm \u003c 1.5.8\n\n**Patched versions:**\n\n- wasmvm 1.5.5, 2.0.4, 2.1.3\n- cosmwasm-vm 1.5.8, 2.0.7, 2.1.4\n\n## Description of the bug\n\n(Blank for now. We'll add more detail once chains had a chance to upgrade.)\n\n## Patch\n\n- 1.5: https://github.com/CosmWasm/cosmwasm/commit/16eabd681790508b13dac8e67f9e6e61045240ea\n- 2.0: https://github.com/CosmWasm/cosmwasm/commit/0e70bd83119b02f99a2c0397f0913e0803750fd9\n- 2.1: https://github.com/CosmWasm/cosmwasm/commit/f5bf24f3acadca2892afd58cc3ce5fdeb932d492\n\n## Applying the patch\n\nThe patch will be shipped in releases of wasmvm. You can update more or less as follows:\n\n1. Check the current wasmvm version: `go list -m github.com/CosmWasm/wasmvm`\n2. Bump the `github.com/CosmWasm/wasmvm` dependency in your go.mod to 1.5.5, 2.0.4, 2.1.3 depending on which minor version you are; `go mod tidy`; commit.\n3. If you use the static libraries `libwasmvm_muslc.aarch64.a`/`libwasmvm_muslc.x86_64.a`, update them accordingly.\n4. Check the updated wasmvm version: `go list -m github.com/CosmWasm/wasmvm` and ensure you see 1.5.5, 2.0.4, 2.1.3.\n5. Follow your regular practices to deploy chain upgrades.\n\nTo double check if the correct library version is loaded at runtime, use this query:\n`\u003cappd\u003e query wasm libwasmvm-version`. It must show 1.5.5, 2.0.4 or 2.1.3.\n\nThe patch is consensus breaking and requires a coordinated upgrade.\n\n## Acknowledgement\n\nThis issue was found by meadow101 who reported it to the Cosmos Bug Bounty Program on HackerOne.\n\nIf you believe you have found a bug in the Interchain Stack or would like to contribute to the\nprogram by reporting a bug, please see \u003chttps://hackerone.com/cosmos\u003e.\n\n## Timeline\n\n- 2024-08-28: Confio receives a report through the Cosmos bug bounty program maintained by Amulet.\n- 2024-08-30: Confio security contributors confirm the report.\n- 2024-09-02: Confio developed the patch internally.\n- 2024-09-23: Patch is released.\n\n[^1]: following Amulet's Severity Classification Framework ACMv1: https://github.com/interchainio/security/blob/e0227a1fb4059144aab4f6003eeee7f09912db3a/resources/CLASSIFICATION_MATRIX.md","status":"published","published":"2024-12-10T16:55:39Z","modified":"2024-12-10T16:55:39Z","updated_at":"2026-11-02T15:46:34.700741Z"}]}}