Read the docs
TI-2025-43557 Aliases GHSA-mx2j-7cmv-353c

wasmvm: Malicious smart contract can slow down block production

Priority LOW 38Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

# CWA-2025-002 **Severity** Medium (Moderate + Likely)[^1] **Affected versions:** - wasmvm >= 2.2.0, < 2.2.2 - wasmvm >= 2.1.0, < 2.1.5 - wasmvm >= 2.0.0, < 2.0.6 - wasmvm < 1.5.8 **Patched versions:** - wasmvm 1.5.8, 2.0.6, 2.1.5, 2.2.2 ## Description of the bug The vulnerability can be used to slow down block production. The attack requires a malicious contract, so permissioned chains are unlikely to be affected. (We'll add more detail once chains had a chance to upgrade.) ## Patch - 1.5: https://github.com/CosmWasm/cosmwasm/commit/2b7f2faa57a1efc8207455c37f87f1eee6035a27 - 2.0: https://github.com/CosmWasm/cosmwasm/commit/d6143b0aff16a39bbea4be37597d8e9d9b213d3b - 2.1: https://github.com/CosmWasm/cosmwasm/commit/f0c04c03cbe2557634c1bbcdc2ce203fe7caca58 - 2.2: https://github.com/CosmWasm/cosmwasm/commit/a5d62f65b5eb947ebe40e2085b1c48a9d0a244d0 ## Applying the patch The patch will be shipped in releases of wasmvm. You can update more or less as follows: 1. Check the current wasmvm version: `go list -m github.com/CosmWasm/wasmvm` 2. Bump the `github.com/CosmWasm/wasmvm` dependency in your go.mod to one of the patched version depending on which minor version you are on; `go mod tidy`; commit. 3. If you use the static libraries `libwasmvm_muslc.aarch64.a`/`libwasmvm_muslc.x86_64.a`, update them accordingly. 4. Check the updated wasmvm version: `go list -m github.com/CosmWasm/wasmvm` and ensure you see 1.5.8, 2.0.6, 2.1.5 or 2.2.2. 5. Follow your regular practices to deploy chain upgrades. The patch is consensus breaking and requires a coordinated upgrade. ## Acknowledgement This issue was found by meadow101 who reported it to the Cosmos Bug Bounty Program on HackerOne. If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see <https://hackerone.com/cosmos>. ## Timeline - 2024-11-24: Confio receives a report through the Cosmos bug bounty program maintained by Amulet. - 2024-12-20: Confio security contributors confirm the report. - 2024-01-27: Confio developed the patch internally. - 2025-02-04: Patch gets released. [^1]: following Amulet's Severity Classification Framework ACMv1.2: https://github.com/interchainio/security/blob/0295254e8645301ccb606d46108a45cede0a73e0/resources/CLASSIFICATION_MATRIX.md

Why it matters now

Fix Fixed cosmwasm-vm (crates.io): 2.2.1, 2.1.6, 2.0.9 +1github.com/CosmWasm/wasmvm (Go): 1.5.8, 0.0.0-20250204093451-1f4db20199b8, 1.5.8-0.20250204093451-1f4db20199b8+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—cosmwasm-vm (crates.io)2.2.0 to before 2.2.12.2.1Patch availableGHSA-mx2j-7cmv-353c
—cosmwasm-vm (crates.io)2.1.0 to before 2.1.62.1.6Patch availableGHSA-mx2j-7cmv-353c
—cosmwasm-vm (crates.io)2.0.0 to before 2.0.92.0.9Patch availableGHSA-mx2j-7cmv-353c
—cosmwasm-vm (crates.io)before 1.5.101.5.10Patch availableGHSA-mx2j-7cmv-353c
—github.com/CosmWasm/wasmvm (Go)0.1.0 to before 1.5.81.5.8Patch availableGHSA-mx2j-7cmv-353c
—github.com/CosmWasm/wasmvm/v2 (Go)2.2.0 to before 2.2.22.2.2Patch availableGHSA-mx2j-7cmv-353c
—github.com/CosmWasm/wasmvm/v2 (Go)2.1.0 to before 2.1.52.1.5Patch availableGHSA-mx2j-7cmv-353c
—github.com/CosmWasm/wasmvm/v2 (Go)2.0.0 to before 2.0.62.0.6Patch availableGHSA-mx2j-7cmv-353c
—github.com/CosmWasm/wasmvm (Go)before 0.0.0-20250204093451-1f4db20199b80.0.0-20250204093451-1f4db20199b8Patch availableGHSA-mx2j-7cmv-353c
—github.com/CosmWasm/wasmvm/v2 (Go)before 2.0.0-20250204103256-d62c3b826a9d2.0.0-20250204103256-d62c3b826a9dPatch availableGHSA-mx2j-7cmv-353c
—github.com/CosmWasm/wasmvm (Go)1.5.8-0 to before 1.5.8-0.20250204093451-1f4db20199b81.5.8-0.20250204093451-1f4db20199b8Patch availableGHSA-mx2j-7cmv-353c
—github.com/CosmWasm/wasmvm/v2 (Go)2.0.6-0 to before 2.0.6-0.20250204103256-d62c3b826a9d2.0.6-0.20250204103256-d62c3b826a9dPatch availableGHSA-mx2j-7cmv-353c
  • cosmwasm-vm (crates.io) Vendor— Affected 2.2.0 to before 2.2.1 Fixed in 2.2.1 Patch available GHSA-mx2j-7cmv-353c
  • cosmwasm-vm (crates.io) Vendor— Affected 2.1.0 to before 2.1.6 Fixed in 2.1.6 Patch available GHSA-mx2j-7cmv-353c
  • cosmwasm-vm (crates.io) Vendor— Affected 2.0.0 to before 2.0.9 Fixed in 2.0.9 Patch available GHSA-mx2j-7cmv-353c
  • cosmwasm-vm (crates.io) Vendor— Affected before 1.5.10 Fixed in 1.5.10 Patch available GHSA-mx2j-7cmv-353c
  • github.com/CosmWasm/wasmvm (Go) Vendor— Affected 0.1.0 to before 1.5.8 Fixed in 1.5.8 Patch available GHSA-mx2j-7cmv-353c
  • github.com/CosmWasm/wasmvm/v2 (Go) Vendor— Affected 2.2.0 to before 2.2.2 Fixed in 2.2.2 Patch available GHSA-mx2j-7cmv-353c
  • github.com/CosmWasm/wasmvm/v2 (Go) Vendor— Affected 2.1.0 to before 2.1.5 Fixed in 2.1.5 Patch available GHSA-mx2j-7cmv-353c
  • github.com/CosmWasm/wasmvm/v2 (Go) Vendor— Affected 2.0.0 to before 2.0.6 Fixed in 2.0.6 Patch available GHSA-mx2j-7cmv-353c
  • github.com/CosmWasm/wasmvm (Go) Vendor— Affected before 0.0.0-20250204093451-1f4db20199b8 Fixed in 0.0.0-20250204093451-1f4db20199b8 Patch available GHSA-mx2j-7cmv-353c
  • github.com/CosmWasm/wasmvm/v2 (Go) Vendor— Affected before 2.0.0-20250204103256-d62c3b826a9d Fixed in 2.0.0-20250204103256-d62c3b826a9d Patch available GHSA-mx2j-7cmv-353c
  • github.com/CosmWasm/wasmvm (Go) Vendor— Affected 1.5.8-0 to before 1.5.8-0.20250204093451-1f4db20199b8 Fixed in 1.5.8-0.20250204093451-1f4db20199b8 Patch available GHSA-mx2j-7cmv-353c
  • github.com/CosmWasm/wasmvm/v2 (Go) Vendor— Affected 2.0.6-0 to before 2.0.6-0.20250204103256-d62c3b826a9d Fixed in 2.0.6-0.20250204103256-d62c3b826a9d Patch available GHSA-mx2j-7cmv-353c

Remediation

  • Fix · GHSA-mx2j-7cmv-353c cosmwasm-vm (crates.io) Fixed in 2.2.1 Advisory →
  • Fix · GHSA-mx2j-7cmv-353c cosmwasm-vm (crates.io) Fixed in 2.1.6 Advisory →
  • Fix · GHSA-mx2j-7cmv-353c cosmwasm-vm (crates.io) Fixed in 2.0.9 Advisory →
  • Fix · GHSA-mx2j-7cmv-353c cosmwasm-vm (crates.io) Fixed in 1.5.10 Advisory →
  • Fix · GHSA-mx2j-7cmv-353c github.com/CosmWasm/wasmvm (Go) Fixed in 1.5.8 Advisory →
  • Fix · GHSA-mx2j-7cmv-353c github.com/CosmWasm/wasmvm/v2 (Go) Fixed in 2.2.2 Advisory →
  • Fix · GHSA-mx2j-7cmv-353c github.com/CosmWasm/wasmvm/v2 (Go) Fixed in 2.1.5 Advisory →
  • Fix · GHSA-mx2j-7cmv-353c github.com/CosmWasm/wasmvm/v2 (Go) Fixed in 2.0.6 Advisory →
  • Fix · GHSA-mx2j-7cmv-353c github.com/CosmWasm/wasmvm (Go) Fixed in 0.0.0-20250204093451-1f4db20199b8 Advisory →
  • Fix · GHSA-mx2j-7cmv-353c github.com/CosmWasm/wasmvm/v2 (Go) Fixed in 2.0.0-20250204103256-d62c3b826a9d Advisory →
  • Fix · GHSA-mx2j-7cmv-353c github.com/CosmWasm/wasmvm (Go) Fixed in 1.5.8-0.20250204093451-1f4db20199b8 Advisory →
  • Fix · GHSA-mx2j-7cmv-353c github.com/CosmWasm/wasmvm/v2 (Go) Fixed in 2.0.6-0.20250204103256-d62c3b826a9d Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-mx2j-7cmv-353c

References

Other 8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences