Out-of-bounds read/write and invalid free with `externref`s and GC safepoints in Wasmtime

🗓️ 20 Sep 2021 19:54:16Reported by GitHub Advisory DatabaseType

Out-of-bounds read/write in Wasmtime due to `externref`s

Reporter	Title	Published	Views	Family All 100
Circl	CVE-2021-39218	18 Sep 202100:23	–	circl
CNNVD	Wasmtime 缓冲区错误漏洞	17 Sep 202100:00	–	cnnvd
CVE	CVE-2021-39218	17 Sep 202120:10	–	cve
Cvelist	CVE-2021-39218 Out-of-bounds read/write and invalid free with `externref`s and GC safepoints in Wasmtime	17 Sep 202120:10	–	cvelist
Debian CVE	CVE-2021-39218	17 Sep 202120:10	–	debiancve
EUVD	EUVD-2021-0464	7 Oct 202500:30	–	euvd
Fedora	[SECURITY] Fedora 35 Update: rust-gimli-0.25.0-1.fc35	30 Sep 202100:54	–	fedora
Fedora	[SECURITY] Fedora 34 Update: rust-cranelift-wasm-0.77.0-1.fc34	4 Oct 202101:04	–	fedora
Fedora	[SECURITY] Fedora 34 Update: rust-addr2line-0.16.0-1.fc34	4 Oct 202101:04	–	fedora
Fedora	[SECURITY] Fedora 35 Update: rust-object-0.26.2-1.fc35	30 Sep 202100:54	–	fedora

Vulners

Node

bytecodealliance wasmtimeRange0.26.0–0.30.0rust

Source	Link
github	www.github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4873-36h9-wv49
github	www.github.com/bytecodealliance/wasmtime/commit/398a73f0dd862dbe703212ebae8e34036a18c11c
crates	www.crates.io/crates/wasmtime
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-39218
rustsec	www.rustsec.org/advisories/RUSTSEC-2021-0110.html
github	www.github.com/bytecodealliance/wasmtime-py/compare/0.29.0...0.30.0
github	www.github.com/pypa/advisory-database/tree/main/vulns/wasmtime/PYSEC-2021-321.yaml
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/WAVBRYDDUIY2ZR3K3FO4BVYJKIMJ5TP7
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/Z2Z33FTXFQ6EOINVEQIP4DFBG53G5XIY
github	www.github.com/advisories/GHSA-4873-36h9-wv49

19 Nov 2024 18:04Current

6.5Medium risk

Vulners AI Score6.5

CVSS 23.3

CVSS 3.16.3

EPSS0.00291