CVE-2022-23636
published 2022-02-16CVE-2022-23636: Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.34.1 and 0.33.1, there exists a bug in the pooling instance allocator in…
PriorityP343high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EPSS
0.76%
50.6th percentile
Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.34.1 and 0.33.1, there exists a bug in the pooling instance allocator in Wasmtime's runtime where a failure to instantiate an instance for a module that defines an `externref` global will result in an invalid drop of a `VMExternRef` via an uninitialized pointer. A number of conditions listed in the GitHub Security Advisory must be true in order for an instance to be vulnerable to this issue. Maintainers believe that the effective impact of this bug is relatively small because the usage of `externref` is still uncommon and without a resource limiter configured on the `Store`, which is not the default configuration, it is only possible to trigger the bug from an error returned by `mprotect` or `VirtualAlloc`. Note that on Linux with the `uffd` feature enabled, it is only possible to trigger the bug from a resource limiter as the call to `mprotect` is skipped. The bug has been fixed in 0.34.1 and 0.33.1 and users are encouraged to upgrade as soon as possible. If it is not possible to upgrade to version 0.34.1 or 0.33.1 of the `wasmtime` crate, it is recommend that support for the reference types proposal be disabled by passing `false` to `Config::wasm_reference_types`. Doing so will prevent modules that use `externref` from being loaded entirely.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| bytecodealliance | cranelift-codegen | >= 0 < 0.85.2 | 0.85.2 |
| bytecodealliance | wasmtime | < 0.33.0 | 0.33.0 |
| bytecodealliance | wasmtime | < 0.33.1 | 0.33.1 |
| bytecodealliance | wasmtime | — | — |
| bytecodealliance | wasmtime | — | — |
| bytecodealliance | wasmtime | >= 0 < 0.38.2 | 0.38.2 |
| bytecodealliance | wasmtime | >= 0 < 0.33.1 | 0.33.1 |
| bytecodealliance | wasmtime | >= 0.0.0-0 < 0.38.2 | 0.38.2 |
| bytecodealliance | wasmtime | >= 0.0.0-0 < 0.33.1 | 0.33.1 |
| bytecodealliance | wasmtime | >= 0.34.0 < 0.34.1 | 0.34.1 |
| debian | rust-wasmtime | — | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.1HIGHAV:N/AC:M/Au:N/C:N/I:N/A:C
vendor_debian5.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Cranelift vulnerable to miscompilation of constant values in division on AArch64
osv·2022-07-21
CVE-2022-23636 [MEDIUM] Cranelift vulnerable to miscompilation of constant values in division on AArch64
Cranelift vulnerable to miscompilation of constant values in division on AArch64
### Impact
There was a bug in Wasmtime's code generator, Cranelift, for AArch64 targets where constant divisors could result in incorrect division results at runtime. The translation rules for constants did not take into account whether sign- or zero-extension should happen, which resulted in an incorrect value being placed into a register when a division was encountered. For example, a constant 32-bit unsigned divisor of `0xfffffffe` would be incorrectly sign-extended to 64-bits to `0xfffffffffffffffe`. Any kind of division of operands smaller than 64 bits is implemented with a 64-bit division instruction which would then result in an incorrect result because the divisor was larger than expected.
The impac
OSV
Miscompilation of constant values in division on AArch64
osv·2022-07-05
CVE-2022-23636 Miscompilation of constant values in division on AArch64
Miscompilation of constant values in division on AArch64
This is an entry in the RustSec database for the Wasmtime security advisory
located at
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7f6x-jwh5-m9r4.
For more information see the GitHub-hosted security advisory.
OSV
Invalid drop of VMExternRef from partially-initialized instances in the pooling instance allocator
osv·2022-02-17
CVE-2022-23636 Invalid drop of VMExternRef from partially-initialized instances in the pooling instance allocator
Invalid drop of VMExternRef from partially-initialized instances in the pooling instance allocator
This is an entry in the RustSec database for the Wasmtime security advisory
located at
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-88xq-w8cq-xfg7.
For more information see the GitHub-hosted security advisory.
GHSA
Invalid drop of partially-initialized instances in the pooling instance allocator for modules with defined `externref` globals
ghsa·2022-02-16
CVE-2022-23636 [MEDIUM] CWE-824 Invalid drop of partially-initialized instances in the pooling instance allocator for modules with defined `externref` globals
Invalid drop of partially-initialized instances in the pooling instance allocator for modules with defined `externref` globals
### Impact
There exists a bug in the pooling instance allocator in Wasmtime's runtime where a failure to instantiate an instance for a module that defines an `externref` global will result in an invalid drop of a `VMExternRef` via an uninitialized pointer.
As instance slots may be reused between consecutive instantiations, the value of the uninitialized pointer may be from a previous instantiation and therefore under the control of an attacker via a module's initial values for its globals. If the attacker can somehow determine an address under their control inside the mapped memory representing the instance pool, it is possible to trick the runtime to call `drop
OSV
Invalid drop of partially-initialized instances in the pooling instance allocator for modules with defined `externref` globals
osv·2022-02-16
CVE-2022-23636 [MEDIUM] Invalid drop of partially-initialized instances in the pooling instance allocator for modules with defined `externref` globals
Invalid drop of partially-initialized instances in the pooling instance allocator for modules with defined `externref` globals
### Impact
There exists a bug in the pooling instance allocator in Wasmtime's runtime where a failure to instantiate an instance for a module that defines an `externref` global will result in an invalid drop of a `VMExternRef` via an uninitialized pointer.
As instance slots may be reused between consecutive instantiations, the value of the uninitialized pointer may be from a previous instantiation and therefore under the control of an attacker via a module's initial values for its globals. If the attacker can somehow determine an address under their control inside the mapped memory representing the instance pool, it is possible to trick the runtime to call `drop
Debian
CVE-2022-23636: rust-wasmtime - Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.3...
vendor_debian·2022·CVSS 5.1
CVE-2022-23636 [MEDIUM] CVE-2022-23636: rust-wasmtime - Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.3...
Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.34.1 and 0.33.1, there exists a bug in the pooling instance allocator in Wasmtime's runtime where a failure to instantiate an instance for a module that defines an `externref` global will result in an invalid drop of a `VMExternRef` via an uninitialized pointer. A number of conditions listed in the GitHub Security Advisory must be true in order for an instance to be vulnerable to this issue. Maintainers believe that the effective impact of this bug is relatively small because the usage of `externref` is still uncommon and without a resource limiter configured on the `Store`, which is not the default configuration, it is only possible to trigger the bug from an error returned by `mprotect` or `VirtualAlloc`. Note
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/bytecodealliance/wasmtime/commit/886ecc562040bef61faf19438c22285c2d62403ahttps://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-88xq-w8cq-xfg7https://github.com/bytecodealliance/wasmtime/commit/886ecc562040bef61faf19438c22285c2d62403ahttps://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-88xq-w8cq-xfg7
2022-02-16
Published