CVE-2021-45293: 
NixOS vulnerability analysis and mitigation

A Denial of Service vulnerability was discovered in Binaryen version 103, identified as CVE-2021-45293. The vulnerability is caused by an invalid memory address dereference in the wasm::WasmBinaryBuilder::visitLet function. This security issue was discovered on December 10, 2021, and affects the WebAssembly compiler and toolchain infrastructure library (GitHub Issue).

The vulnerability manifests as a segmentation fault in the wasm::WasmBinaryBuilder::visitLet(wasm::Block*) function. When triggered, the issue causes an invalid memory address dereference, leading to a crash. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (NVD).

The vulnerability results in a Denial of Service condition when exploited. When triggered, it causes the application to crash due to the invalid memory address dereference, potentially disrupting the WebAssembly compilation process (NVD).

The vulnerability was fixed in Binaryen version 104. Users are recommended to upgrade to version 104 or later to address this security issue. The fix was subsequently included in version 105 which was released for Fedora 34 and 35 distributions (Fedora Update).