CVE-2021-39219: Access of Resource Using Incompatible Type

Wasmtime is an open source runtime for WebAssembly & WASI. Wasmtime before version 0.30.0 is affected by a type confusion vulnerability. As a Rust library the wasmtime crate clearly marks which functions are safe and which are unsafe, guaranteeing that if consumers never use unsafe then it should...

CVE-2021-39216: Use After Free

Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.19.0 and before version 0.30.0 there was a use-after-free bug when passing externrefs from the host to guest Wasm content. To trigger the bug, you have to explicitly pass multiple externrefs from the host to a...

GHSA-HPQH-2WQX-7QP5 Memory access due to code generation flaw in Cranelift module

There is a bug in 0.73.0 of the Cranelift x64 backend that can create a scenario that could result in a potential sandbox escape in a WebAssembly module. Users of versions 0.73.0 of Cranelift should upgrade to either 0.73.1 or 0.74 to remediate this vulnerability. Users of Cranelift prior to 0.73...

CVE-2021-32629

Cranelift is an open-source code generator maintained by Bytecode Alliance. It translates a target-independent intermediate representation into executable machine code. There is a bug in 0.73 of the Cranelift x64 backend that can create a scenario that could result in a potential sandbox escape i...

CVE-2021-32629 Memory access due to code generation flaw in Cranelift module

Cranelift is an open-source code generator maintained by Bytecode Alliance. It translates a target-independent intermediate representation into executable machine code. There is a bug in 0.73 of the Cranelift x64 backend that can create a scenario that could result in a potential sandbox escape i...

wasmtime:api_calls: Null-dereference READ in wasmtime_runtime::traphandlers::trap_handler::h7db4407f2ea80b07

Project: https://github.com/bytecodealliance/wasmtime.git Detailed Report: https://oss-fuzz.com/testcase?key=5720162111848448 Project: wasmtime Fuzzing Engine: libFuzzer Fuzz Target: apicalls Job Type: libfuzzerasanwasmtime Platform Id: linux Crash Type: Null-dereference READ Crash Address:...

wasmtime:api_calls: Crash in libgcc_s.so.1

Project: https://github.com/bytecodealliance/wasmtime.git Detailed Report: https://oss-fuzz.com/testcase?key=5092428792725504 Project: wasmtime Fuzzing Engine: libFuzzer Fuzz Target: apicalls Job Type: libfuzzerasanwasmtime Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7fca40c2e294...

wasmtime:api_calls: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5747963460321280 Project: wasmtime Fuzzing Engine: libFuzzer Fuzz Target: apicalls Job Type: libfuzzerasanwasmtime Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7f2b0be55000 Crash State: NULL Sanitizer: address ASAN Recommended...

wasmtime:api_calls: Crash in libgcc_s.so.1

Project: https://github.com/bytecodealliance/wasmtime.git Detailed Report: https://oss-fuzz.com/testcase?key=5653289697542144 Project: wasmtime Fuzzing Engine: libFuzzer Fuzz Target: apicalls Job Type: libfuzzerasanwasmtime Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7f15da00f04f...

wasmtime:differential: Crash in RegisterSetjmp

Detailed Report: https://oss-fuzz.com/testcase?key=6205251766714368 Project: wasmtime Fuzzing Engine: libFuzzer Fuzz Target: differential Job Type: libfuzzerasanwasmtime Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7f4688188004 Crash State: RegisterSetjmp...

lightbeam (>=0.7.0, <=0.15.0), llama-wasm (>=0.1.0, <=0.5.0) +1 more potentially affected by unknown CVE via multi_mut (0.1.3)

multimut CARGO version 0.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on multimut and may be impacted: - lightbeam =0.7.0, =0.1.0, =0.7.0, =0.15.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2020-0169...

wasmtime:differential: Crash with empty stacktrace

Project: https://github.com/bytecodealliance/wasmtime.git Detailed Report: https://oss-fuzz.com/testcase?key=5638872262508544 Project: wasmtime Fuzzing Engine: libFuzzer Fuzz Target: differential Job Type: libfuzzerasanwasmtime Platform Id: linux Crash Type: UNKNOWN READ Crash Address:...

wasmtime:differential: Crash in [stack]

Project: https://github.com/bytecodealliance/wasmtime.git Detailed Report: https://oss-fuzz.com/testcase?key=5637784696258560 Project: wasmtime Fuzzing Engine: libFuzzer Fuzz Target: differential Job Type: libfuzzerasanwasmtime Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address:...

wasmtime:differential: Crash in _fini

Project: https://github.com/bytecodealliance/wasmtime.git Detailed Report: https://oss-fuzz.com/testcase?key=5750187404558336 Project: wasmtime Fuzzing Engine: libFuzzer Fuzz Target: differential Job Type: libfuzzerasanwasmtime Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address:...

wasmtime:api_calls: Crash with empty stacktrace

Project: https://github.com/bytecodealliance/wasmtime.git Detailed Report: https://oss-fuzz.com/testcase?key=5069880397398016 Project: wasmtime Fuzzing Engine: libFuzzer Fuzz Target: apicalls Job Type: libfuzzerasanwasmtime Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x7f52f0071d5...

wasmtime:differential: Crash in [stack]

Project: https://github.com/bytecodealliance/wasmtime.git Detailed Report: https://oss-fuzz.com/testcase?key=5719544398348288 Project: wasmtime Fuzzing Engine: libFuzzer Fuzz Target: differential Job Type: libfuzzerasanwasmtime Platform Id: linux Crash Type: UNKNOWN READ Crash Address:...