CVE-2022-31169Incorrect Calculation in Wasmtime

Severity
7.5HIGHNVD
EPSS
0.3%
top 46.08%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedJul 22

Description

Wasmtime is a standalone runtime for WebAssembly. There is a bug in Wasmtime's code generator, Cranelift, for AArch64 targets where constant divisors can result in incorrect division results at runtime. This affects Wasmtime prior to version 0.38.2 and Cranelift prior to 0.85.2. This issue only affects the AArch64 platform. Other platforms are not affected. The translation rules for constants did not take into account whether sign or zero-extension should happen which resulted in an incorrect va

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages6 packages

CVEListV5bytecodealliance/wasmtime< 0.38.2+1
crates.iobytecodealliance/wasmtime0.0.0-00.38.2+4

Patches

🔴Vulnerability Details

6
OSV
CVE-2022-31169: Wasmtime is a standalone runtime for WebAssembly2022-07-22
GHSA
Cranelift vulnerable to miscompilation of constant values in division on AArch642022-07-21
OSV
Cranelift vulnerable to miscompilation of constant values in division on AArch642022-07-21
OSV
Miscompilation of constant values in division on AArch642022-07-05
OSV
Invalid drop of VMExternRef from partially-initialized instances in the pooling instance allocator2022-02-17

📋Vendor Advisories

1
Debian
CVE-2022-31169: rust-wasmtime - Wasmtime is a standalone runtime for WebAssembly. There is a bug in Wasmtime's c...2022