CVE-2022-28990: 
Python vulnerability analysis and mitigation

WASM3 v0.5.0 was discovered to contain a heap overflow vulnerability in the WASI read/write API component, specifically via /wabt/bin/poc.wasm. The vulnerability was identified and disclosed on April 7, 2022 (GitHub Issue).

The vulnerability stems from the WASI API's handling of iovs (I/O vectors), where the implementation fails to properly check the iovs' buffer address and buffer length, resulting in out-of-bounds memory access. The issue has been assigned a CVSS v3.1 Base Score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-787 (Out-of-bounds Write) (NVD).

When exploited, this vulnerability leads to heap buffer overflow, potentially resulting in memory information leakage and system crashes. When tested with Address Sanitizer (ASAN), the vulnerability triggers a heap-buffer-overflow detection, specifically showing a READ operation of size 28672 at an unauthorized memory location (GitHub Issue).

The vulnerability was addressed through a fix that implements proper buffer overflow checks in the WASI API read/write and pread/pwrite operations. The fix was merged into the main branch through pull request #324 (GitHub PR).