CVE-2022-31104
published 2022-06-28CVE-2022-31104: Wasmtime is a standalone runtime for WebAssembly. In affected versions wasmtime's implementation of the SIMD proposal for WebAssembly on x86_64 contained two…
PriorityP432medium5.6CVSS 3.1
AVNACHPRNUINSUCLILAL
EPSS
1.63%
73.1th percentile
Wasmtime is a standalone runtime for WebAssembly. In affected versions wasmtime's implementation of the SIMD proposal for WebAssembly on x86_64 contained two distinct bugs in the instruction lowerings implemented in Cranelift. The aarch64 implementation of the simd proposal is not affected. The bugs were presented in the `i8x16.swizzle` and `select` WebAssembly instructions. The `select` instruction is only affected when the inputs are of `v128` type. The correspondingly affected Cranelift instructions were `swizzle` and `select`. The `swizzle` instruction lowering in Cranelift erroneously overwrote the mask input register which could corrupt a constant value, for example. This means that future uses of the same constant may see a different value than the constant itself. The `select` instruction lowering in Cranelift wasn't correctly implemented for vector types that are 128-bits wide. When the condition was 0 the wrong instruction was used to move the correct input to the output of the instruction meaning that only the low 32 bits were moved and the upper 96 bits of the result were left as whatever the register previously contained (instead of the input being moved from). The `select` instruction worked correctly if the condition was nonzero, however. This bug in Wasmtime's implementation of these instructions on x86_64 represents an incorrect implementation of the specified semantics of these instructions according to the WebAssembly specification. The impact of this is benign for hosts running WebAssembly but represents possible vulnerabilities within the execution of a guest program. For example a WebAssembly program could take unintended branches or materialize incorrect values internally which runs the risk of exposing the program itself to other related vulnerabilities which can occur from miscompilations. We have released Wasmtime 0.38.1 and cranelift-codegen (and other associated cranelift crates) 0.85.1 which contain the corrected implementations of these
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| bytecodealliance | cranelift-codegen | < 0.85.0 | 0.85.0 |
| bytecodealliance | cranelift-codegen | >= 0 < 0.85.1 | 0.85.1 |
| bytecodealliance | wasmtime | < 0.38.1 | 0.38.1 |
| bytecodealliance | wasmtime | — | — |
| bytecodealliance | wasmtime | — | — |
| bytecodealliance | wasmtime | >= 0 < 0.38.1 | 0.38.1 |
| bytecodealliance | wasmtime | >= 0.0.0-0 < 0.38.1 | 0.38.1 |
| debian | rust-wasmtime | — | — |
| msrc | azl3_mozjs_102.15.1-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_rust_1.75.0-14_on_azure_linux_3.0 | — | — |
| msrc | azl3_rust_1.86.0-1_on_azure_linux_3.0 | — | — |
CVSS provenance
nvdv3.15.6MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
vendor_debian4.8LOW
vendor_msrc4.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Miscompilation of `i8x16.swizzle` and `select` with v128 inputs in Wasmtime
vendor_msrc·2022-06-14·CVSS 4.8
CVE-2022-31104 [MEDIUM] CWE-682 Miscompilation of `i8x16.swizzle` and `select` with v128 inputs in Wasmtime
Miscompilation of `i8x16.swizzle` and `select` with v128 inputs in Wasmtime
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Debian
CVE-2022-31104: rust-wasmtime - Wasmtime is a standalone runtime for WebAssembly. In affected versions wasmtime'...
vendor_debian·2022·CVSS 4.8
CVE-2022-31104 [MEDIUM] CVE-2022-31104: rust-wasmtime - Wasmtime is a standalone runtime for WebAssembly. In affected versions wasmtime'...
Wasmtime is a standalone runtime for WebAssembly. In affected versions wasmtime's implementation of the SIMD proposal for WebAssembly on x86_64 contained two distinct bugs in the instruction lowerings implemented in Cranelift. The aarch64 implementation of the simd proposal is not affected. The bugs were presented in the `i8x16.swizzle` and `select` WebAssembly instructions. The `select` instruction is only affected when the inputs are of `v128` type. The correspondingly affected Cranelift instructions were `swizzle` and `select`. The `swizzle` instruction lowering in Cranelift erroneously overwrote the mask input register which could corrupt a constant value, for example. This means that future uses of the same constant may see a different value than the constant itself. The `select` inst
OSV
Miscompilation of `i8x16.swizzle` and `select` with v128 inputs
osv·2022-06-29
CVE-2022-31104 [MEDIUM] Miscompilation of `i8x16.swizzle` and `select` with v128 inputs
Miscompilation of `i8x16.swizzle` and `select` with v128 inputs
### Impact
Wasmtime's implementation of the [SIMD proposal for WebAssembly](https://github.com/webassembly/simd) on x86_64 contained two distinct bugs in the instruction lowerings implemented in Cranelift. The aarch64 implementation of the simd proposal is not affected. The bugs were presented in the `i8x16.swizzle` and `select` WebAssembly instructions. The `select` instruction is only affected when the inputs are of `v128` type. The correspondingly affected Cranelift instructions were `swizzle` and `select`.
The `swizzle` instruction lowering in Cranelift erroneously overwrote the mask input register which could corrupt a constant value, for example. This means that future uses of the same constant may see a different val
GHSA
Miscompilation of `i8x16.swizzle` and `select` with v128 inputs
ghsa·2022-06-29
CVE-2022-31104 [MEDIUM] CWE-682 Miscompilation of `i8x16.swizzle` and `select` with v128 inputs
Miscompilation of `i8x16.swizzle` and `select` with v128 inputs
### Impact
Wasmtime's implementation of the [SIMD proposal for WebAssembly](https://github.com/webassembly/simd) on x86_64 contained two distinct bugs in the instruction lowerings implemented in Cranelift. The aarch64 implementation of the simd proposal is not affected. The bugs were presented in the `i8x16.swizzle` and `select` WebAssembly instructions. The `select` instruction is only affected when the inputs are of `v128` type. The correspondingly affected Cranelift instructions were `swizzle` and `select`.
The `swizzle` instruction lowering in Cranelift erroneously overwrote the mask input register which could corrupt a constant value, for example. This means that future uses of the same constant may see a different val
OSV
Miscompilation of `i8x16.swizzle` and `select` with v128 inputs
osv·2022-06-27
CVE-2022-31104 Miscompilation of `i8x16.swizzle` and `select` with v128 inputs
Miscompilation of `i8x16.swizzle` and `select` with v128 inputs
This is an entry in the RustSec database for the Wasmtime security advisory
located at
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqwc-c49r-4w2x.
For more information see the GitHub-hosted security advisory.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://docs.rs/wasmtime/latest/wasmtime/struct.Config.html#method.wasm_simdhttps://github.com/bytecodealliance/wasmtime/pull/4317https://github.com/bytecodealliance/wasmtime/pull/4318https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqwc-c49r-4w2xhttps://github.com/webassembly/simdhttps://webassembly.github.io/spec/https://docs.rs/wasmtime/latest/wasmtime/struct.Config.html#method.wasm_simdhttps://github.com/bytecodealliance/wasmtime/pull/4317https://github.com/bytecodealliance/wasmtime/pull/4318https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqwc-c49r-4w2xhttps://github.com/webassembly/simdhttps://webassembly.github.io/spec/
2022-06-28
Published