CVE-2023-48105: 
Fluent Bit vulnerability analysis and mitigation

An heap overflow vulnerability was discovered in Bytecode alliance wasm-micro-runtime v.1.2.3 which allows a remote attacker to cause a denial of service via the wasm_loader_prepare_bytecode function in core/iwasm/interpreter/wasm_loader.c. The vulnerability was disclosed on November 22, 2023 (NVD).

The vulnerability is a heap-based buffer overflow that occurs in the wasm_loader_prepare_bytecode function located in core/iwasm/interpreter/wasm_loader.c. The issue manifests as a heap out-of-bounds read of size 1 at line 7141. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 HIGH with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

When successfully exploited, this vulnerability allows remote attackers to cause a denial of service condition in the affected application. The heap buffer overflow can lead to application crashes and service disruption (NVD).

The vulnerability can be triggered remotely without requiring authentication or user interaction. A proof of concept exploit has been publicly disclosed that demonstrates the heap buffer overflow condition (GitHub Issue).

The vulnerability has been patched in a subsequent release. Users should upgrade to a patched version of the software. A fix was implemented that adds additional buffer boundary checks in the wasm loader (GitHub Patch).