CVE-2023-48105: 
Fluent Bit vulnerability analysis and mitigation

An heap overflow vulnerability was discovered in Bytecode alliance wasm-micro-runtime v.1.2.3 which allows a remote attacker to cause a denial of service via the wasmloaderpreparebytecode function in core/iwasm/interpreter/wasmloader.c. The vulnerability was disclosed on November 22, 2023 (NVD).

The vulnerability is a heap-based buffer overflow that occurs in the wasmloaderpreparebytecode function located in core/iwasm/interpreter/wasmloader.c. The issue manifests as a heap out-of-bounds read of size 1 at line 7141. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 HIGH with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

When successfully exploited, this vulnerability allows remote attackers to cause a denial of service condition in the affected application. The heap buffer overflow can lead to application crashes and service disruption (NVD).

The vulnerability has been patched in a subsequent release. Users should upgrade to a patched version of the software. A fix was implemented that adds additional buffer boundary checks in the wasm loader (GitHub Patch).