CVE-2022-43282: 
NixOS vulnerability analysis and mitigation

wasm-interp v1.0.29 was discovered to contain an out-of-bounds read vulnerability in the OnReturnCallIndirectExpr->GetReturnCallDropKeepCount component. The vulnerability was disclosed in September 2022 and affects the WebAssembly Binary Toolkit (WABT) (GitHub Issue).

The vulnerability is classified as an out-of-bounds read issue with a CVSS v3.1 base score of 7.1 (HIGH). The attack vector is local (AV:L), with low attack complexity (AC:L), requires no privileges (PR:N), needs user interaction (UI:R), has an unchanged scope (S:U), and can result in high confidentiality and availability impact (C:H, A:H) with no integrity impact (I:N) (NVD Database).

The vulnerability can lead to unauthorized memory access and potential system crashes. When exploited, it can cause a denial of service condition through segmentation faults and potentially expose sensitive information through memory reads (NVD Database).

The vulnerability can be triggered through a specially crafted WebAssembly file that targets the GetReturnCallDropKeepCount function. A proof of concept has been documented that demonstrates the ability to cause a segmentation fault through this vulnerability (GitHub Issue).

The issue has been fixed in versions after 1.0.29. Debian has addressed this in version 1.0.30-1 for the unstable distribution. Users are recommended to upgrade to the fixed version (Debian Security).