CVE-2024-28123: 
Rust vulnerability analysis and mitigation

Wasmi, an efficient and lightweight WebAssembly interpreter focused on constrained and embedded systems, was found to contain an Out-of-bounds Buffer Write vulnerability (CVE-2024-28123). The vulnerability was discovered in versions 0.15.0 through 0.31.0 and was patched in version 0.31.1. The issue occurs when the host calls or resumes a Wasm function with more parameters than the default limit of 128, causing it to surpass the stack value. Importantly, this vulnerability only affects calls from host to Wasm, not Wasm to Wasm calls (GHSA Advisory).

The vulnerability is classified as Critical and is identified as CWE-787 (Out-of-bounds Write). The issue manifests when calling or resuming Wasm functions from the host side with more than 128 parameters, leading to a buffer overflow condition. The CVSS v3.1 score is 7.3 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L (NVD).

The vulnerability could potentially be exploited when external users are allowed to call Wasm functions with more than 128 parameters from the host side, representing a serious attack vector. However, major systems like Polkadot's pallet_contracts are not affected as they implement restrictions on the number of parameters in host to Wasm function calls (Release Notes).

The vulnerability is exploitable in scenarios where users can call Wasm functions with more than 128 parameters from the host side. However, this is considered a rare scenario as functions with such a high number of parameters are uncommon. The bug specifically affects host to Wasm function calls and does not impact Wasm to Wasm calls (GHSA Advisory).

The vulnerability has been patched in version 0.31.1. Users running versions between 0.15.0 and 0.31.0 are strongly advised to upgrade to the patched version. As a workaround, users can ensure that no more than 128 parameters are passed in calls from the host to a Wasm function (GHSA Advisory, Release Notes).

The vulnerability was responsibly disclosed by the Stellar Development Foundation, leading to a prompt patch release. Analysis of dependent systems including Polkadot systems, Pallet Contracts, Parity Signer, and Smoldot revealed that these systems were not affected due to their implementation of limited parameter counts in host to Wasm function calls (GHSA Advisory).