ceres-executor (>=0.1.0, <=0.2.0), inkpad-executor (0.1.0) +17 more potentially affected by CVE-2021-39216 +2 more via wasmtime (>=0.26.1, <=0.29.0)

wasmtime CARGO version =0.26.1, =0.1.0, =0.1.2, =0.26.0, =0.26.0, =0.26.0, =0.26.0, =0.26.0, =0.26.0, =0.29.0 and more Source cves: CVE-2021-39216, CVE-2021-39218, CVE-2021-39219 Source advisory: OSV:GHSA-4873-36H9-WV49...

ceres-executor (>=0.1.0, <=0.2.0), inkpad-executor (0.1.0) +17 more potentially affected by CVE-2021-39218 via wasmtime (>=0.26.1, <=0.29.0)

wasmtime CARGO version =0.26.1, =0.1.0, =0.1.2, =0.26.0, =0.26.0, =0.26.0, =0.26.0, =0.26.0, =0.26.0, =0.29.0 and more Source cves: CVE-2021-39218 Source advisory: GHSA-4873-36H9-WV49...

nmigen-yosys (0.9.0.post3746.dev32), yowasp-nextpnr-ecp5 (>=0.0.0.post3645.dev165, <=0.0.0.post3816.dev218) +14 more potentially affected by CVE-2021-39216 +2 more via wasmtime (>=0.27.0, <=0.28.1)

wasmtime PYPI version =0.27.0, =0.0.0.post3645.dev165, =0.0.0.post3645.dev165, =0.0.0.post3645.dev165, =0.0.0.post3645.dev165, =0.0.0.post3645.dev165, =0.0.0.post3694.dev181, =0.0.0.post3645.dev165, =0.0.0.post3645.dev165, =0.0.0.post3645.dev165, =0.0.0.post3645.dev165, =0.0.0.post3645.dev165,...

nmigen-yosys (0.9.0.post3746.dev32), yowasp-nextpnr-ecp5 (>=0.0.0.post3645.dev165, <=0.0.0.post3816.dev218) +14 more potentially affected by CVE-2021-39218 via wasmtime (>=0.27.0, <=0.28.1)

wasmtime PYPI version =0.27.0, =0.0.0.post3645.dev165, =0.0.0.post3645.dev165, =0.0.0.post3645.dev165, =0.0.0.post3645.dev165, =0.0.0.post3645.dev165, =0.0.0.post3694.dev181, =0.0.0.post3645.dev165, =0.0.0.post3645.dev165, =0.0.0.post3645.dev165, =0.0.0.post3645.dev165, =0.0.0.post3645.dev165,...

Out-of-bounds read/write and invalid free with `externref`s and GC safepoints in Wasmtime

Impact There was an invalid free and out-of-bounds read and write bug when running Wasm that uses externrefs in Wasmtime. To trigger this bug, Wasmtime needs to be running Wasm that uses externrefs, the host creates non-null externrefs, Wasmtime performs a garbage collection GC, and there has to ...

auto-wasi (0.1.0), ceres-executor (>=0.1.0, <=0.2.0) +28 more potentially affected by CVE-2021-39216 +2 more via wasmtime (>=0.7.0, <=0.29.0)

wasmtime CARGO version =0.7.0, =0.1.0, =0.8.0-alpha.2, =0.8.0-alpha.2, =0.1.1, =0.1.1, =0.1.2, =0.2.1, =0.9.0 - wasi-binio-host 0.1.0 - wasm-embedded-rt 0.1.0 and more Source cves: CVE-2021-39216, CVE-2021-39218, CVE-2021-39219 Source advisory: OSV:GHSA-V4CP-H94R-M7XF...

memquery (0.1.1), nmigen-yosys (>=0.9.0.post3527.dev26, <=0.9.0.post3746.dev32) +15 more potentially affected by CVE-2021-39216 +2 more via wasmtime (>=0.18.2, <=0.28.1)

wasmtime PYPI version =0.18.2, =0.9.0.post3527.dev26, =0.0.0.post2625.dev9, =0.0.0.post2625.dev9, =0.0.0.post2625.dev9, =0.0.0.post2625.dev9, =0.0.0.post2625.dev9, =0.0.0.post3694.dev181, =0.0.0.post2616.dev1, =0.0.0.post2616.dev1, =0.0.0.post2616.dev1, =0.0.0.post2616.dev1, =0.0.0.post2616.dev1,...

GHSA-V4CP-H94R-M7XF Use after free passing `externref`s to Wasm in Wasmtime

Impact There was a use-after-free bug when passing externrefs from the host to guest Wasm content. To trigger the bug, you have to explicitly pass multiple externrefs from the host to a Wasm instance at the same time, either by passing multiple externrefs as arguments from host code to a Wasm...

auto-wasi (0.1.0), ceres-executor (>=0.1.0, <=0.2.0) +28 more potentially affected by CVE-2021-39216 via wasmtime (>=0.7.0, <=0.29.0)

wasmtime CARGO version =0.7.0, =0.1.0, =0.8.0-alpha.2, =0.8.0-alpha.2, =0.1.1, =0.1.1, =0.1.2, =0.2.1, =0.9.0 - wasi-binio-host 0.1.0 - wasm-embedded-rt 0.1.0 and more Source cves: CVE-2021-39216 Source advisory: GHSA-V4CP-H94R-M7XF...

memquery (0.1.1), nmigen-yosys (>=0.9.0.post3527.dev26, <=0.9.0.post3746.dev32) +15 more potentially affected by CVE-2021-39216 via wasmtime (>=0.18.2, <=0.28.1)

wasmtime PYPI version =0.18.2, =0.9.0.post3527.dev26, =0.0.0.post2625.dev9, =0.0.0.post2625.dev9, =0.0.0.post2625.dev9, =0.0.0.post2625.dev9, =0.0.0.post2625.dev9, =0.0.0.post3694.dev181, =0.0.0.post2616.dev1, =0.0.0.post2616.dev1, =0.0.0.post2616.dev1, =0.0.0.post2616.dev1, =0.0.0.post2616.dev1,...

Use after free passing `externref`s to Wasm in Wasmtime

Impact There was a use-after-free bug when passing externrefs from the host to guest Wasm content. To trigger the bug, you have to explicitly pass multiple externrefs from the host to a Wasm instance at the same time, either by passing multiple externrefs as arguments from host code to a Wasm...

CVE-2021-39218

Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.26.0 and before version 0.30.0 is affected by a memory unsoundness vulnerability. There was an invalid free and out-of-bounds read and write bug when running Wasm that uses externrefs in Wasmtime. To trigger thi...

CVE-2021-39218

Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.26.0 and before version 0.30.0 is affected by a memory unsoundness vulnerability. There was an invalid free and out-of-bounds read and write bug when running Wasm that uses externrefs in Wasmtime. To trigger thi...

PYSEC-2021-321

Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.26.0 and before version 0.30.0 is affected by a memory unsoundness vulnerability. There was an invalid free and out-of-bounds read and write bug when running Wasm that uses externrefs in Wasmtime. To trigger thi...

memquery (0.1.1), nmigen-yosys (>=0.9.0.post3527.dev26, <=0.9.0.post3746.dev32) +15 more potentially affected by CVE-2021-39216 +2 more via wasmtime (>=0.18.2, <=0.28.1)

wasmtime PYPI version =0.18.2, =0.9.0.post3527.dev26, =0.0.0.post2625.dev9, =0.0.0.post2625.dev9, =0.0.0.post2625.dev9, =0.0.0.post2625.dev9, =0.0.0.post2625.dev9, =0.0.0.post3694.dev181, =0.0.0.post2616.dev1, =0.0.0.post2616.dev1, =0.0.0.post2616.dev1, =0.0.0.post2616.dev1, =0.0.0.post2616.dev1,...

CVE-2021-39218

Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.26.0 and before version 0.30.0 is affected by a memory unsoundness vulnerability. There was an invalid free and out-of-bounds read and write bug when running Wasm that uses externrefs in Wasmtime. To trigger thi...

Design/Logic Flaw

Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.26.0 and before version 0.30.0 is affected by a memory unsoundness vulnerability. There was an invalid free and out-of-bounds read and write bug when running Wasm that uses externrefs in Wasmtime. To trigger thi...

PYSEC-2021-321

Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.26.0 and before version 0.30.0 is affected by a memory unsoundness vulnerability. There was an invalid free and out-of-bounds read and write bug when running Wasm that uses externrefs in Wasmtime. To trigger thi...

CVE-2021-39219

Wasmtime is an open source runtime for WebAssembly & WASI. Wasmtime before version 0.30.0 is affected by a type confusion vulnerability. As a Rust library the wasmtime crate clearly marks which functions are safe and which are unsafe, guaranteeing that if consumers never use unsafe then it should...

CVE-2021-39219

Wasmtime is an open source runtime for WebAssembly & WASI. Wasmtime before version 0.30.0 is affected by a type confusion vulnerability. As a Rust library the wasmtime crate clearly marks which functions are safe and which are unsafe, guaranteeing that if consumers never use unsafe then it should...