CVE-2022-31169 — Incorrect Calculation in Wasmtime

Vendor	Product	Version range	Fixed in
bytecodealliance	cranelift-codegen	< 0.85.1	0.85.1
bytecodealliance	cranelift-codegen	>= 0 < 0.85.2	0.85.2
bytecodealliance	wasmtime	< 0.38.2	0.38.2
bytecodealliance	wasmtime	< 0.85.2	0.85.2
bytecodealliance	wasmtime	< 0.38.1	0.38.1
bytecodealliance	wasmtime	>= 0 < 0.38.2	0.38.2
bytecodealliance	wasmtime	>= 0 < 0.33.1	0.33.1
bytecodealliance	wasmtime	>= 0.0.0-0 < 0.38.2	0.38.2
bytecodealliance	wasmtime	>= 0.0.0-0 < 0.33.1	0.33.1
bytecodealliance	wasmtime	>= 0.34.0 < 0.34.1	0.34.1
debian	rust-wasmtime	—	—

OSV

CVE-2022-31169: Wasmtime is a standalone runtime for WebAssembly

osv·2022-07-22·CVSS 7.5

CVE-2022-31169 [HIGH] CVE-2022-31169: Wasmtime is a standalone runtime for WebAssembly Wasmtime is a standalone runtime for WebAssembly. There is a bug in Wasmtime's code generator, Cranelift, for AArch64 targets where constant divisors can result in incorrect division results at runtime. This affects Wasmtime prior to version 0.38.2 and Cranelift prior to 0.85.2. This issue only affects the AArch64 platform. Other platforms are not affected. The translation rules for constants did not take into account whether sign or zero-extension should happen which resulted in an incorrect value being placed into a register when a division was encountered. The impact of this bug is that programs executing within the WebAssembly sandbox would not behave according to the WebAssembly specification. This means that it is hypothetically possible for execution within the sandbox to go awry an

GHSA

Cranelift vulnerable to miscompilation of constant values in division on AArch64

ghsa·2022-07-21

CVE-2022-31169 [MEDIUM] CWE-682 Cranelift vulnerable to miscompilation of constant values in division on AArch64 Cranelift vulnerable to miscompilation of constant values in division on AArch64 ### Impact There was a bug in Wasmtime's code generator, Cranelift, for AArch64 targets where constant divisors could result in incorrect division results at runtime. The translation rules for constants did not take into account whether sign- or zero-extension should happen, which resulted in an incorrect value being placed into a register when a division was encountered. For example, a constant 32-bit unsigned divisor of `0xfffffffe` would be incorrectly sign-extended to 64-bits to `0xfffffffffffffffe`. Any kind of division of operands smaller than 64 bits is implemented with a 64-bit division instruction which would then result in an incorrect result because the divisor was larger than expected. The impac

OSV

Cranelift vulnerable to miscompilation of constant values in division on AArch64

osv·2022-07-21

CVE-2022-23636 [MEDIUM] Cranelift vulnerable to miscompilation of constant values in division on AArch64 Cranelift vulnerable to miscompilation of constant values in division on AArch64 ### Impact There was a bug in Wasmtime's code generator, Cranelift, for AArch64 targets where constant divisors could result in incorrect division results at runtime. The translation rules for constants did not take into account whether sign- or zero-extension should happen, which resulted in an incorrect value being placed into a register when a division was encountered. For example, a constant 32-bit unsigned divisor of `0xfffffffe` would be incorrectly sign-extended to 64-bits to `0xfffffffffffffffe`. Any kind of division of operands smaller than 64 bits is implemented with a 64-bit division instruction which would then result in an incorrect result because the divisor was larger than expected. The impac

OSV

Miscompilation of constant values in division on AArch64

osv·2022-07-05

CVE-2022-23636 Miscompilation of constant values in division on AArch64 Miscompilation of constant values in division on AArch64 This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7f6x-jwh5-m9r4. For more information see the GitHub-hosted security advisory.

OSV

Invalid drop of VMExternRef from partially-initialized instances in the pooling instance allocator

osv·2022-02-17

CVE-2022-23636 Invalid drop of VMExternRef from partially-initialized instances in the pooling instance allocator Invalid drop of VMExternRef from partially-initialized instances in the pooling instance allocator This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-88xq-w8cq-xfg7. For more information see the GitHub-hosted security advisory.

OSV

Invalid drop of partially-initialized instances in the pooling instance allocator for modules with defined `externref` globals

osv·2022-02-16

CVE-2022-23636 [MEDIUM] Invalid drop of partially-initialized instances in the pooling instance allocator for modules with defined `externref` globals Invalid drop of partially-initialized instances in the pooling instance allocator for modules with defined `externref` globals ### Impact There exists a bug in the pooling instance allocator in Wasmtime's runtime where a failure to instantiate an instance for a module that defines an `externref` global will result in an invalid drop of a `VMExternRef` via an uninitialized pointer. As instance slots may be reused between consecutive instantiations, the value of the uninitialized pointer may be from a previous instantiation and therefore under the control of an attacker via a module's initial values for its globals. If the attacker can somehow determine an address under their control inside the mapped memory representing the instance pool, it is possible to trick the runtime to call `drop

Debian

CVE-2022-31169: rust-wasmtime - Wasmtime is a standalone runtime for WebAssembly. There is a bug in Wasmtime's c...

vendor_debian·2022·CVSS 5.9

CVE-2022-31169 [MEDIUM] CVE-2022-31169: rust-wasmtime - Wasmtime is a standalone runtime for WebAssembly. There is a bug in Wasmtime's c... Wasmtime is a standalone runtime for WebAssembly. There is a bug in Wasmtime's code generator, Cranelift, for AArch64 targets where constant divisors can result in incorrect division results at runtime. This affects Wasmtime prior to version 0.38.2 and Cranelift prior to 0.85.2. This issue only affects the AArch64 platform. Other platforms are not affected. The translation rules for constants did not take into account whether sign or zero-extension should happen which resulted in an incorrect value being placed into a register when a division was encountered. The impact of this bug is that programs executing within the WebAssembly sandbox would not behave according to the WebAssembly specification. This means that it is hypothetically possible for execution within the sandbox to go awry an

CVE-2022-31169: Wasmtime is a standalone runtime for WebAssembly. There is a bug in Wasmtime's code generator, Cranelift, for AArch64 targets where constant divisors can…

Affected

CVSS provenance