Wasmer Access Control Error Vulnerability

Wasmer is a Wasmer open source application that enables lightweight containers to run anywhere. An Access Control Error vulnerability exists in Wasmer 3.0.0 and later versions that stems from allowing Wasmer programs to access file systems outside of the sandbox...

Wasmer filesystem sandbox not enforced

Summary As of Wasmer version v4.2.3, Wasm programs can access the filesystem outside of the sandbox. Details https://github.com/wasmerio/wasmer/issues/4267 PoC A minimal Rust program: fn main let f = std::fs::OpenOptions::new .writetrue .createnewtrue .open"abc" .unwrap; This should be compiled...

GHSA-4MQ4-7RW3-VM5J Wasmer filesystem sandbox not enforced

Summary As of Wasmer version v4.2.3, Wasm programs can access the filesystem outside of the sandbox. Details https://github.com/wasmerio/wasmer/issues/4267 PoC A minimal Rust program: fn main let f = std::fs::OpenOptions::new .writetrue .createnewtrue .open"abc" .unwrap; This should be compiled...

assemblylift-cli (>=0.4.0-alpha.5, <=0.4.0-alpha.11), assemblylift-core (>=0.4.0-alpha.10, <=0.4.0-alpha.11) +46 more potentially affected by CVE-2023-26489 via wasmtime (>=0.37.0, <=3.0.1)

wasmtime CARGO version =0.37.0, =0.4.0-alpha.5, =0.4.0-alpha.10, =0.1.0, =0.1.0, =0.1.3, =0.5.0, =0.5.1, =0.0.1, =0.0.1-alpha, =0.11.0, =0.3.1, =0.0.6, =0.1.0, =0.2.1 - linera-wit-bindgen-gen-host-wasmtime-rust 0.2.0 and more Source cves: CVE-2023-26489 Source advisory: OSV:GHSA-FF4P-7XRQ-Q5R8...

auto-wasi (0.1.0), ceres-executor (>=0.1.0, <=0.2.0) +82 more potentially affected by CVE-2022-31104 via wasmtime (>=0.7.0, <=0.37.0)

wasmtime CARGO version =0.7.0, =0.1.0, =0.1.1, =0.5.3-0, =0.4.0-pre, =0.4.0-pre, =0.0.0, =0.40.1, =0.45.0, =0.10.0, =0.1.0, =0.1.0, =0.3.0 - inkpad-executor 0.1.0 and more Source cves: CVE-2022-31104 Source advisory: OSV:GHSA-JQWC-C49R-4W2X...

wasmtime-cli (>=0.35.0, <=0.35.1) potentially affected by CVE-2022-24791 via wasmtime (>=0.35.0, <=0.35.1)

wasmtime CARGO version =0.35.0, =0.35.0, =0.35.1 Source cves: CVE-2022-24791 Source advisory: OSV:RUSTSEC-2022-0016...

auto-wasi (0.1.0), ceres-executor (>=0.1.0, <=0.2.0) +50 more potentially affected by CVE-2022-24791 via wasmtime (>=0.7.0, <=0.34.1)

wasmtime CARGO version =0.7.0, =0.1.0, =0.0.0, =0.40.1, =0.45.0, =0.10.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.3, =0.1.0, =0.4.1 and more Source cves: CVE-2022-24791 Source advisory: OSV:RUSTSEC-2022-0099...