CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
AI Score
Confidence
High
EPSS
Percentile
15.5%
The 19.0.0 release of Wasmtime contains a regression introduced during its development which can lead to a guest WebAssembly module causing a panic in the host runtime. A valid WebAssembly module, when executed at runtime, may cause this panic. The panic in question is caused when a WebAssembly module issues a table.*
instruction which uses a dropped element segment with a table that also has an externref
type. This causes Wasmtime to erroneously use an empty function segment instead of an empty externref segment to perform this operation. This mismatch in types causes a panic in Wasmtime when it’s asserted that an externref table is only viewed as externrefs.
This regression was introduced during the development of the 19.0.0 release and only affects the 19.0.0 release. This panic requires the reference-types
WebAssembly feature to be enabled, and it is enabled by default. Toolchains are not known to generate this pattern by default so it’s likely a module would need to be specifically crafted to trigger this panic.
A panic in a host runtime represents a possible denial-of-service in some scenarios. This panic cannot introduce memory unsafety or allow WebAssembly to break outside of its sandbox, however. There is no possible heap corruption or memory unsafety from this panic.
Wasmtime 19.0.1 has been released to fix this problem. Users of 19.0.0 should upgrade to 19.0.1. All other versions of Wasmtime are not affected by this issue.
If upgrading is not possible it’s recommended to use config.reference_types(false)
. That will disable these modules at validation-time which prevents the possibility of a panic at runtime. If reference-types are required, however, then there is no other workaround at this time other than upgrading.
Vendor | Product | Version | CPE |
---|---|---|---|
bytecodealliance | wasmtime | 19.0.0 | cpe:2.3:a:bytecodealliance:wasmtime:19.0.0:*:*:*:*:*:*:* |
github.com/advisories/GHSA-75hq-h6g9-h4q5
github.com/bytecodealliance/wasmtime/commit/7f57d0bb0948fa56cc950278d0db230ed10e8664
github.com/bytecodealliance/wasmtime/issues/8281
github.com/bytecodealliance/wasmtime/pull/8018
github.com/bytecodealliance/wasmtime/pull/8283
github.com/bytecodealliance/wasmtime/security/advisories/GHSA-75hq-h6g9-h4q5
nvd.nist.gov/vuln/detail/CVE-2024-30266