Lucene search

CVE-2023-26489

🗓️ 08 Mar 2023 20:09:15Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 246 Views🌐 WEB

Wasmtime codegen bug allows malicious module to read/write memory in the 34G-away region

5 of 5AI Insights are available for you today

Leverage the power of AI to quickly understand vulnerabilities, impacts, and exploitability

Reporter	Title	Published	Views	Family All 13
Prion	Out-of-bounds	8 Mar 202320:15	–	prion
OSV	CVE-2023-26489	8 Mar 202320:15	–	osv
OSV	CGA-M5C2-CQ7F-2WFV	6 Jun 202412:28	–	osv
OSV	CGA-XFJC-2627-77G7	21 Nov 202414:21	–	osv
OSV	GHSA-FF4P-7XRQ-Q5R8 wasmtime vulnerable to guest-controlled out-of-bounds read/write on x86_64	9 Mar 202300:10	–	osv
OSV	RUSTSEC-2023-0090 Guest-controlled out-of-bounds read/write on x86\_64	2 Mar 202312:00	–	osv
NVD	CVE-2023-26489	8 Mar 202320:15	–	nvd
Github Security Blog	wasmtime vulnerable to guest-controlled out-of-bounds read/write on x86_64	9 Mar 202300:10	–	github
Cvelist	CVE-2023-26489 Guest-controlled out-of-bounds read/write on x86_64 in wasmtime	8 Mar 202319:59	–	cvelist
Vulnrichment	CVE-2023-26489 Guest-controlled out-of-bounds read/write on x86_64 in wasmtime	8 Mar 202319:59	–	vulnrichment

Nvd

Vulners

Node

bytecodealliance cranelift-codegenRange0.84.0–0.91.1rust

bytecodealliance cranelift-codegenMatch0.92.0rust

bytecodealliance cranelift-codegenMatch0.93.0rust

bytecodealliance wasmtimeRange0.37.0–4.0.1rust

bytecodealliance wasmtimeMatch5.0.0rust

bytecodealliance wasmtimeMatch6.0.0rust

[
  {
    "vendor": "bytecodealliance",
    "product": "wasmtime",
    "versions": [
      {
        "version": "cranelift-codegen: >= 0.84.0, < 0.91.1",
        "status": "affected"
      },
      {
        "version": "cranelift-codegen: >= 0.92.0, < 0.92.1",
        "status": "affected"
      },
      {
        "version": "cranelift-codegen: >= 0.93.0, < 0.93.1",
        "status": "affected"
      },
      {
        "version": " wasmtime: >= 0.37.0, < 4.0.1",
        "status": "affected"
      },
      {
        "version": " wasmtime: >= 5.0.0, < 5.0.1",
        "status": "affected"
      },
      {
        "version": " wasmtime: >= 6.0.0, < 6.0.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/bytecodealliance/wasmtime/commit/63fb30e4b4415455d47b3da5a19d79c12f4f2d1f
docs	www.docs.rs/wasmtime/latest/wasmtime/struct.Config.html
docs	www.docs.rs/wasmtime/latest/wasmtime/struct.Config.html
groups	www.groups.google.com/a/bytecodealliance.org/g/sec-announce/c/Mov-ItrNJsQ
github	www.github.com/bytecodealliance/wasmtime/security/advisories/GHSA-ff4p-7xrq-q5r8

Parameter	Position	Path	Description	CWE
Config::static_memory_maximum_size(0)	query param	wasmtime	Vulnerability in WebAssembly memory access due to incorrect address computation allowing excessive memory read/write.	CWE-787, CWE-125
Config::static_memory_guard_size(1 << 36)	query param	wasmtime	Vulnerability in WebAssembly memory access due to incorrect address computation allowing excessive memory read/write.	CWE-787, CWE-125

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

08 Mar 2023 20:15Current

9.6High risk

Vulners AI Score9.6

CVSS39.9

EPSS0.01169

SSVC