CVE-2022-24791

The CVE refers to Wasmtime (WebAssembly JIT runtime using Cranelift) with a use-after-free vulnerability that occurs when running Wasm code using externrefs while epoch interruption is enabled. The issue is caused by Cranelift failing to emit stack maps for safepoints inside cold blocks, which re...

CVE-2022-31104

CVE-2022-31104 concerns Wasmtime’s x86_64 SIMD implementation. Two Cranelift lowering bugs affected i8x16.swizzle and select for v128 inputs: swizzle overwrote the mask input register, potentially corrupting a constant; and select incorrectly handled 128‑bit vectors when the condition was 0, movi...

CVE-2022-31146

CVE-2022-31146 affects Wasmtime (Cranelift) in the migration to the regalloc2 allocator (Wasmtime 0.37.0). The bug may cause metadata for reference-typed functions to be missing during GC, making the GC pass think there are no live references, leading to use-after-free when values are later acces...

CVE-2022-23636

CVE-2022-23636 affects Wasmtime prior to 0.34.1 and 0.33.1, due to a bug in the pooling instance allocator that can cause an invalid drop of a VMExternRef when a module defines an externref global and instance creation fails. The vulnerability depends on specific conditions (e.g., mprotect/Virtua...

CVE-2022-31169

CVE-2022-31169 affects Wasmtime’s Cranelift codegen on AArch64. A miscompilation in constant division may place incorrect values in registers due to sign/zero-extension rules, impacting WebAssembly sandbox correctness. Affected: Wasmtime prior to 0.38.2 and Cranelift prior to 0.85.2; fixed in Was...

CVE-2022-39392

CVE-2022-39392 affects Wasmtime’s pooling instance allocator when InstanceLimits::memory_pages is set to zero. In this configuration, the virtual memory mapping for WebAssembly memories can fail to meet safety requirements, allowing out-of-bounds reads/writes to access memory outside the wasm san...

CVE-2022-39393

Wasmtime vulnerability CVE-2022-39393: prior to versions 2.0.2 and 1.0.2, a bug in the pooling instance allocator can cause the initial heap snapshot of a prior instance to be visible to the next instance when reusing linear memory. This data leakage between instances can lead to information expo...

CVE-2022-39394

CVE-2022-39394 affects Wasmtime prior to 2.0.2: a mismatch in the wasmtime_trap_code C API implementation can cause a 4-byte write into a 1-byte caller buffer, writing three zero bytes beyond the provided location. The issue is fixed in Wasmtime 2.0.2. Workaround: cast a 4-byte buffer to a 1-byte...