wasmtime-cli (0.34.0) potentially affected by CVE-2022-23636 +1 more via wasmtime (0.34.0)

wasmtime CARGO version 0.34.0 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - wasmtime-cli 0.34.0 Source cves: CVE-2022-23636, CVE-2022-31169 Source advisory: OSV:GHSA-88XQ-W8CQ-XFG7...

Invalid drop of partially-initialized instances in the pooling instance allocator for modules with defined `externref` globals

Impact There exists a bug in the pooling instance allocator in Wasmtime's runtime where a failure to instantiate an instance for a module that defines an externref global will result in an invalid drop of a VMExternRef via an uninitialized pointer. As instance slots may be reused between...

auto-wasi (0.1.0), ceres-executor (>=0.1.0, <=0.2.0) +46 more potentially affected by CVE-2022-23636 +1 more via wasmtime (>=0.7.0, <=0.33.0)

wasmtime CARGO version =0.7.0, =0.1.0, =0.40.1, =0.45.0, =0.10.0, =0.1.0, =0.1.0, =0.1.0, =0.3.3, =0.1.0, =0.2.0 - paxforth 0.1.0 and more Source cves: CVE-2022-23636, CVE-2022-31169 Source advisory: OSV:GHSA-88XQ-W8CQ-XFG7...

CVE-2022-23636

Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.34.1 and 0.33.1, there exists a bug in the pooling instance allocator in Wasmtime's runtime where a failure to instantiate an instance for a module that defines an externref global will result in an invalid drop of a...

Default configuration

Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.34.1 and 0.33.1, there exists a bug in the pooling instance allocator in Wasmtime's runtime where a failure to instantiate an instance for a module that defines an externref global will result in an invalid drop of a...

CVE-2022-23636

Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.34.1 and 0.33.1, there exists a bug in the pooling instance allocator in Wasmtime's runtime where a failure to instantiate an instance for a module that defines an "externref" global will result in an invalid drop of a...

CVE-2022-23636

Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.34.1 and 0.33.1, there exists a bug in the pooling instance allocator in Wasmtime's runtime where a failure to instantiate an instance for a module that defines an externref global will result in an invalid drop of a...

CVE-2022-23636

CVE-2022-23636 affects Wasmtime prior to 0.34.1 and 0.33.1, due to a bug in the pooling instance allocator that can cause an invalid drop of a VMExternRef when a module defines an externref global and instance creation fails. The vulnerability depends on specific conditions (e.g., mprotect/Virtua...

CVE-2022-23636 Invalid drop of partially-initialized instances in wasmtime

Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.34.1 and 0.33.1, there exists a bug in the pooling instance allocator in Wasmtime's runtime where a failure to instantiate an instance for a module that defines an externref global will result in an invalid drop of a...

CVE-2022-23636 Invalid drop of partially-initialized instances in wasmtime

Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.34.1 and 0.33.1, there exists a bug in the pooling instance allocator in Wasmtime's runtime where a failure to instantiate an instance for a module that defines an externref global will result in an invalid drop of a...

PT-2022-20583 · Wasmtime +1 · Wasmtime +1

Name of the Vulnerable Software and Affected Versions: Wasmtime versions prior to 0.38.2 Cranelift versions prior to 0.85.2 Description: There is a bug in Wasmtime's code generator, Cranelift, for AArch64 targets where constant divisors can result in incorrect division results at runtime. The...

PT-2022-16149

Name of the Vulnerable Software and Affected Versions Wasmtime versions prior to 0.34.1 and 0.33.1 Description A bug exists in the pooling instance allocator in Wasmtime's runtime. When a failure to instantiate an instance for a module that defines an externref global occurs, it results in an...

CVE-2022-23636: Access of Uninitialized Pointer

Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.34.1 and 0.33.1, there exists a bug in the pooling instance allocator in Wasmtime's runtime where a failure to instantiate an instance for a module that defines an externref global will result in an invalid drop of a...

Wasmtime 缓冲区错误漏洞

Wasmtime, a Bytecode Consortium project, is a standalone wasm-optimized runtime for WebAssembly and WASI only. Wasmtime suffers from a buffer error vulnerability that stems from a bug in Wasmtime's pooled instance allocator, where failure to instantiate an instance for a module that defines an...

wasmtime:instantiate-many: Segv on unknown address in core::ptr::drop_in_place$LT$wasmtime_runtime..instance..Instance$GT$::h41cb0d5e5

Project: https://github.com/bytecodealliance/wasmtime.git Detailed Report: https://oss-fuzz.com/testcase?key=5305807502180352 Project: wasmtime Fuzzing Engine: libFuzzer Fuzz Target: instantiate-many Job Type: libfuzzerasanwasmtime Platform Id: linux Crash Type: Segv on unknown address Crash...

wasmtime:differential_v8: Segv on unknown address in wasmtime_setjmp

Project: https://github.com/bytecodealliance/wasmtime.git Detailed Report: https://oss-fuzz.com/testcase?key=5275057444749312 Project: wasmtime Fuzzing Engine: libFuzzer Fuzz Target: differentialv8 Job Type: libfuzzerasanwasmtime Platform Id: linux Crash Type: Segv on unknown address Crash Addres...

Fedora: Security Advisory for rust-wasmtime-types (FEDORA-2021-1805eacb48)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for rust-wasmtime-cache (FEDORA-2021-1805eacb48)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for rust-wasmtime-fiber (FEDORA-2021-1805eacb48)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for rust-wasmtime-environ (FEDORA-2021-1805eacb48)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...