CVE-2024-34250

What it actually does

Heap buffer overflow in the wasm_loader_check_br function allows an attacker to trigger memory corruption that results in denial of service.

Why it matters to the business

Systems running the affected database software may experience unplanned outages and service disruption until the vulnerable component is updated.

How an attack unfolds

An attacker supplies specially crafted WebAssembly bytecode that reaches the vulnerable loader function, causing the heap overflow and process termination. No known threat actors or ransomware campaigns have been associated with this issue.

How to fix it

Upgrade virtuoso-opensource to the fixed package versions supplied by the distribution (Ubuntu Pro ESM updates for 16.04/18.04/20.04/22.04/24.04 and Debian 13 package 7.2.12+dfsg-0.2 or later).

How to confirm the fix worked

Confirm the installed package version matches or exceeds the distributor-provided fixed version for the operating system release in use.

Typical attack path

1. Identify a target system running an affected version of the database software
2. Craft or obtain WebAssembly bytecode that triggers the loader check function
3. Cause the vulnerable code path to execute, resulting in heap corruption and crash

How to detect it

Review process crash logs and core dumps around the time of suspected incidents for signs of unexpected termination in the database engine; no specific post-exploitation artifacts are known.

What your security team should do

• Apply the distributor-supplied security updates at the earliest maintenance window
• Review and test the update in a non-production environment before broad deployment
• Monitor upstream release notes for any additional related fixes