Cosmwasm Cherry security patch (#4954) #5404
Conversation
* upgrade wasmvm * get the proper version of wasmvm
| // v16 upgrade handler | ||
| fmt.Println("Running v16 pre-upgrade handler") | ||
| // remove the wasm cache for cosmwasm cherry https://github.com/CosmWasm/advisories/blob/main/CWAs/CWA-2023-002.md#wasm-module-cache-issue | ||
| err := os.RemoveAll(app.homePath + "/wasm/wasm/cache") |
There was a problem hiding this comment.
Is it possible someone has that configured under a different path? How should we handle that?
There was a problem hiding this comment.
I don't think this is configurable, but I'll double check. If they did and the path is not available as a variable in the code, then I think it's OK to ask for them to delete the directory manually
There was a problem hiding this comment.
${homedir}/wasm is hard coded here: https://github.com/osmosis-labs/wasmd/blob/master/x/wasm/keeper/keeper_cgo.go#L37
Then the cache is initialized in init_cache on libwasmvm https://github.com/CosmWasm/wasmvm/blob/main/libwasmvm/src/cache.rs#L28 which calls Cache::new() that has those paths hardcoded: https://github.com/CosmWasm/cosmwasm/blob/main/packages/vm/src/cache.rs#LL120C1-L122C51
|
Merging after answering the comment about cache paths |
Closes: #4964
What is the purpose of the change
Update wasmvm to deal with https://github.com/CosmWasm/advisories/blob/main/CWAs/CWA-2023-002.md#wasm-module-cache-issue
Testing and Verifying
All tests should pass. Manually verified the version on the compiled binary
Documentation and Release Note
Unreleasedsection ofCHANGELOG.md? AddedWhere is the change documented?
x/{module}/README.md)