Bytecode Alliance Wasmtime 安全漏洞

Bytecode Alliance Wasmtime is a standalone WebAssembly and WASI-only wasm optimization software open-sourced by Bytecode Alliance. A security vulnerability exists in Bytecode Alliance Wasmtime that stems from a file system sandbox implementation on Windows that does not block access to special...

RUSTSEC-2024-0438 Wasmtime doesn't fully sandbox all the Windows device filenames

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-c2f5-jxjv-2hh8. For more information see the GitHub-hosted security advisory...

PT-2024-34878

Name of the Vulnerable Software and Affected Versions Wasmtime versions prior to 24.0.2 Wasmtime versions prior to 25.0.3 Wasmtime versions prior to 26.0.1 Description The issue concerns Wasmtime's filesystem sandbox implementation on Windows, which fails to block access to special device filenam...

wasmtime:cranelift-fuzzgen: Segv on unknown address in cranelift_filetests::function_runner::Trampoline::call::hb2e77cf3a13ebaf4

Project: https://github.com/bytecodealliance/wasmtime.git Detailed Report: https://oss-fuzz.com/testcase?key=6434594980691968 Project: wasmtime Fuzzing Engine: libFuzzer Fuzz Target: cranelift-fuzzgen Job Type: libfuzzerasanwasmtime Platform Id: linux Crash Type: Segv on unknown address Crash...

Wasmtime race condition could lead to WebAssembly control-flow integrity and type safety violations

Impact Under certain concurrent event orderings, a wasmtime::Engine's internal type registry was susceptible to double-unregistration bugs due to a race condition, leading to panics and potentially type registry corruption. That registry corruption could, following an additional and particular...

GHSA-7QMX-3FPX-R45M Wasmtime race condition could lead to WebAssembly control-flow integrity and type safety violations

Impact Under certain concurrent event orderings, a wasmtime::Engine's internal type registry was susceptible to double-unregistration bugs due to a race condition, leading to panics and potentially type registry corruption. That registry corruption could, following an additional and particular...

wasmtime has a runtime crash when combining tail calls with trapping imports

Impact Wasmtime's implementation of WebAssembly tail calls combined with stack traces can result in a runtime crash in certain WebAssembly modules. The runtime crash may be undefined behavior if Wasmtime was compiled with Rust 1.80 or prior. The runtime crash is a deterministic process abort when...

candid-extractor (>=0.1.0, <=0.1.2), purewasm (0.1.0) +12 more potentially affected by CVE-2024-47763 via wasmtime (12.0.2)

wasmtime CARGO version 12.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - candid-extractor =0.1.0, =12.0.0, =12.0.0, =12.0.0, =0.1.2, =0.3.0, =12.0.0, =12.0.0, =12.0.0, =12.0.0, =12.0.0, =12.0.2 Source cves:...

GHSA-Q8HX-MM92-4WVG wasmtime has a runtime crash when combining tail calls with trapping imports

Impact Wasmtime's implementation of WebAssembly tail calls combined with stack traces can result in a runtime crash in certain WebAssembly modules. The runtime crash may be undefined behavior if Wasmtime was compiled with Rust 1.80 or prior. The runtime crash is a deterministic process abort when...

CVE-2024-47763

Wasmtime is an open source runtime for WebAssembly. Wasmtime's implementation of WebAssembly tail calls combined with stack traces can result in a runtime crash in certain WebAssembly modules. The runtime crash may be undefined behavior if Wasmtime was compiled with Rust 1.80 or prior. The runtim...

wasm-cli-runner (>=0.0.1, <=1.0.0) potentially affected by CVE-2024-47813 via wasmtime (3.0.0)

wasmtime PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - wasm-cli-runner =0.0.1, =1.0.0 Source cves: CVE-2024-47813 Source advisory: OSV:PYSEC-2024-311...

itkwasm (1.0.0b140) potentially affected by CVE-2024-47813 via wasmtime (13.0.0)

wasmtime PYPI version 13.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - itkwasm 1.0.0b140 Source cves: CVE-2024-47813 Source advisory: OSV:PYSEC-2024-311...

amaranth-yosys (0.25.0.0.post78), yowasp-runtime (>=1.41.0, <=1.42.0) potentially affected by CVE-2024-47813 via wasmtime (14.0.0)

wasmtime PYPI version 14.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - amaranth-yosys 0.25.0.0.post78 - yowasp-runtime =1.41.0, =1.42.0 Source cves: CVE-2024-47813 Source advisory: OSV:PYSEC-2024-311...

amaranth-yosys (0.25.0.0.post70), yowasp-runtime (1.19.0) potentially affected by CVE-2024-47813 via wasmtime (7.0.0)

wasmtime PYPI version 7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - amaranth-yosys 0.25.0.0.post70 - yowasp-runtime 1.19.0 Source cves: CVE-2024-47813 Source advisory: OSV:PYSEC-2024-311...

amaranth-yosys (0.25.0.0.post71), yowasp-runtime (>=1.20.0, <=1.21.0) potentially affected by CVE-2024-47813 via wasmtime (8.0.1)

wasmtime PYPI version 8.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - amaranth-yosys 0.25.0.0.post71 - yowasp-runtime =1.20.0, =1.21.0 Source cves: CVE-2024-47813 Source advisory: OSV:PYSEC-2024-311...

amaranth-yosys (0.40.0.0.post98), devcycle-python-server-sdk (>=3.6.1, <=3.10.0) +1 more potentially affected by CVE-2024-47813 via wasmtime (23.0.0)

wasmtime PYPI version 23.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - amaranth-yosys 0.40.0.0.post98 - devcycle-python-server-sdk =3.6.1, =3.10.0 - yowasp-runtime 1.63.0 Source cves: CVE-2024-47813 Source advisory...

yowasp-nextpnr-ecp5 (>=0.0.0.post3694.dev181, <=0.0.0.post3816.dev218), yowasp-nextpnr-ecp5-25k (>=0.0.0.post3694.dev181, <=0.0.0.post3816.dev218) +13 more potentially affected by CVE-2024-47813 via wasmtime (0.28.1)

wasmtime PYPI version 0.28.1 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - yowasp-nextpnr-ecp5 =0.0.0.post3694.dev181, =0.0.0.post3694.dev181, =0.0.0.post3694.dev181, =0.0.0.post3694.dev181, =0.0.0.post3694.dev181,...

amaranth-yosys (0.40.0.0.post100), coreblocks (>=0.2026.7.3, <=0.2026.10.4) +4 more potentially affected by CVE-2024-47813 via wasmtime (25.0.0)

wasmtime PYPI version 25.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - amaranth-yosys 0.40.0.0.post100 - coreblocks =0.2026.7.3, =0.1.0, =0.5.0rc1, =0.5.1rc0 - yowasp-runtime 1.65.0 Source cves: CVE-2024-47813 Sour...

DEBIAN-CVE-2024-47813

Wasmtime is an open source runtime for WebAssembly. Under certain concurrent event orderings, a wasmtime::Engine's internal type registry was susceptible to double-unregistration bugs due to a race condition, leading to panics and potentially type registry corruption. That registry corruption...

amaranth-yosys (>=0.40.0.0.post96, <=0.40.0.0.post97), yowasp-runtime (>=1.60.0, <=1.62.0) potentially affected by CVE-2024-47813 via wasmtime (22.0.0)

wasmtime PYPI version 22.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - amaranth-yosys =0.40.0.0.post96, =1.60.0, =1.62.0 Source cves: CVE-2024-47813 Source advisory: OSV:PYSEC-2024-311...