Multiple Vulnerabilities in Wasmtime

Use after free passing externrefs to Wasm in Wasmtime Out-of-bounds read/write and invalid free with externrefs and GC safepoints in Wasmtime Wrong type for Linker-define functions when used across two Engines...

CVE-2021-39216: Use After Free

Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.19.0 and before version 0.30.0 there was a use-after-free bug when passing externrefs from the host to guest Wasm content. To trigger the bug, you have to explicitly pass multiple externrefs from the host to a...

CVE-2021-39219: Access of Resource Using Incompatible Type

Wasmtime is an open source runtime for WebAssembly & WASI. Wasmtime before version 0.30.0 is affected by a type confusion vulnerability. As a Rust library the wasmtime crate clearly marks which functions are safe and which are unsafe, guaranteeing that if consumers never use unsafe then it should...

Wasmtime 代码问题漏洞

Wasmtime, a Bytecode Consortium project, is a standalone wasm-optimized runtime for WebAssembly and WASI only. A code issue vulnerability exists in Wasmtime that stems from Wasmtime prior to version 0.30.0 being affected by a type obfuscation vulnerability...

Wasmtime 缓冲区错误漏洞

Wasmtime, a Bytecode Consortium project, is a standalone wasm-optimized runtime for WebAssembly and WASI only. Wasmtime suffers from a buffer error vulnerability that stems from an invalid free and out-of-bounds read/write error when running Wasm due to a memory unsoundness vulnerability in...

Wasmtime 资源管理错误漏洞

Wasmtime, a Bytecode Consortium project, is a standalone wasm optimization runtime for WebAssembly and WASI only. A resource management error vulnerability exists in Wasmtime that stems from a post-release usage error when passing multiple externrefs from the host to guest Wasm content...

PT-2021-22469

Name of the Vulnerable Software and Affected Versions Wasmtime versions 0.19.0 through 0.29.0 Wasmtime versions 0.26.0 through 0.29.0 Description There is a memory unsoundness vulnerability in Wasmtime, which can be triggered when running Wasm that uses externrefs. This can result in an invalid...

PT-2021-22470

Name of the Vulnerable Software and Affected Versions Wasmtime versions prior to 0.30.0 Description A type confusion vulnerability was discovered in the safe API of Linker::func APIs. This issue occurs when one Engine is used to create the Linker and then a different Engine is used to create a...

PT-2021-22468

Name of the Vulnerable Software and Affected Versions Wasmtime versions 0.19.0 through 0.29.0 Description The issue is related to a use-after-free bug when passing externrefs from the host to guest Wasm content. To trigger the bug, multiple externrefs must be passed from the host to a Wasm instan...

CVE-2021-39218: Free of Memory not on the Heap

Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.26.0 and before version 0.30.0 is affected by a memory unsoundness vulnerability. There was an invalid free and out-of-bounds read and write bug when running Wasm that uses externrefs in Wasmtime. To trigger thi...

memquery (0.1.1), nmigen-yosys (>=0.9.0.post3527.dev26, <=0.9.0.post3746.dev31) +13 more potentially affected by CVE-2021-32629 via wasmtime (>=0.18.2, <=0.25.0)

wasmtime PYPI version =0.18.2, =0.9.0.post3527.dev26, =0.0.0.post2625.dev9, =0.0.0.post2625.dev9, =0.0.0.post2625.dev9, =0.0.0.post2625.dev9, =0.0.0.post2625.dev9, =0.0.0.post2616.dev1, =0.0.0.post2616.dev1, =0.0.0.post2616.dev1, =0.0.0.post2616.dev1, =0.0.0.post2616.dev1, =0.0.0.post2616.dev1,...

GHSA-HPQH-2WQX-7QP5 Memory access due to code generation flaw in Cranelift module

There is a bug in 0.73.0 of the Cranelift x64 backend that can create a scenario that could result in a potential sandbox escape in a WebAssembly module. Users of versions 0.73.0 of Cranelift should upgrade to either 0.73.1 or 0.74 to remediate this vulnerability. Users of Cranelift prior to 0.73...

CVE-2021-32629

Cranelift is an open-source code generator maintained by Bytecode Alliance. It translates a target-independent intermediate representation into executable machine code. There is a bug in 0.73 of the Cranelift x64 backend that can create a scenario that could result in a potential sandbox escape i...

memquery (0.1.1), nmigen-yosys (>=0.9.0.post3527.dev26, <=0.9.0.post3746.dev31) +13 more potentially affected by CVE-2021-32629 via wasmtime (>=0.18.2, <=0.25.0)

wasmtime PYPI version =0.18.2, =0.9.0.post3527.dev26, =0.0.0.post2625.dev9, =0.0.0.post2625.dev9, =0.0.0.post2625.dev9, =0.0.0.post2625.dev9, =0.0.0.post2625.dev9, =0.0.0.post2616.dev1, =0.0.0.post2616.dev1, =0.0.0.post2616.dev1, =0.0.0.post2616.dev1, =0.0.0.post2616.dev1, =0.0.0.post2616.dev1,...

CVE-2021-32629 Memory access due to code generation flaw in Cranelift module

Cranelift is an open-source code generator maintained by Bytecode Alliance. It translates a target-independent intermediate representation into executable machine code. There is a bug in 0.73 of the Cranelift x64 backend that can create a scenario that could result in a potential sandbox escape i...

wasmtime:api_calls: Null-dereference READ in wasmtime_runtime::traphandlers::trap_handler::h7db4407f2ea80b07

Project: https://github.com/bytecodealliance/wasmtime.git Detailed Report: https://oss-fuzz.com/testcase?key=5720162111848448 Project: wasmtime Fuzzing Engine: libFuzzer Fuzz Target: apicalls Job Type: libfuzzerasanwasmtime Platform Id: linux Crash Type: Null-dereference READ Crash Address:...

wasmtime:api_calls: Crash in libgcc_s.so.1

Project: https://github.com/bytecodealliance/wasmtime.git Detailed Report: https://oss-fuzz.com/testcase?key=5092428792725504 Project: wasmtime Fuzzing Engine: libFuzzer Fuzz Target: apicalls Job Type: libfuzzerasanwasmtime Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7fca40c2e294...

wasmtime:api_calls: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5747963460321280 Project: wasmtime Fuzzing Engine: libFuzzer Fuzz Target: apicalls Job Type: libfuzzerasanwasmtime Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7f2b0be55000 Crash State: NULL Sanitizer: address ASAN Recommended...

wasmtime:api_calls: Crash in libgcc_s.so.1

Project: https://github.com/bytecodealliance/wasmtime.git Detailed Report: https://oss-fuzz.com/testcase?key=5653289697542144 Project: wasmtime Fuzzing Engine: libFuzzer Fuzz Target: apicalls Job Type: libfuzzerasanwasmtime Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7f15da00f04f...

wasmtime:differential: Crash in RegisterSetjmp

Detailed Report: https://oss-fuzz.com/testcase?key=6205251766714368 Project: wasmtime Fuzzing Engine: libFuzzer Fuzz Target: differential Job Type: libfuzzerasanwasmtime Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7f4688188004 Crash State: RegisterSetjmp...