CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-31169 – Cranelift vulnerable to miscompilation of constant values in division on AArch64
https://notcve.org/view.php?id=CVE-2022-31169
Wasmtime is a standalone runtime for WebAssembly. There is a bug in Wasmtime's code generator, Cranelift, for AArch64 targets where constant divisors can result in incorrect division results at runtime. This affects Wasmtime prior to version 0.38.2 and Cranelift prior to 0.85.2. This issue only affects the AArch64 platform. Other platforms are not affected. • https://github.com/bytecodealliance/wasmtime/commit/2ba4bce5cc719e5a74e571a534424614e62ecc41 https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7f6x-jwh5-m9r4 • CWE-682: Incorrect Calculation •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-31104 – Miscompilation of `i8x16.swizzle` and `select` with v128 inputs in Wasmtime
https://notcve.org/view.php?id=CVE-2022-31104
Wasmtime is a standalone runtime for WebAssembly. In affected versions wasmtime's implementation of the SIMD proposal for WebAssembly on x86_64 contained two distinct bugs in the instruction lowerings implemented in Cranelift. The aarch64 implementation of the simd proposal is not affected. The bugs were presented in the `i8x16.swizzle` and `select` WebAssembly instructions. The `select` instruction is only affected when the inputs are of `v128` type. • https://docs.rs/wasmtime/latest/wasmtime/struct.Config.html#method.wasm_simd https://github.com/bytecodealliance/wasmtime/pull/4317 https://github.com/bytecodealliance/wasmtime/pull/4318 https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqwc-c49r-4w2x https://github.com/webassembly/simd https://webassembly.github.io/spec • CWE-682: Incorrect Calculation •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-23636 – Invalid drop of partially-initialized instances in wasmtime
https://notcve.org/view.php?id=CVE-2022-23636
Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.34.1 and 0.33.1, there exists a bug in the pooling instance allocator in Wasmtime's runtime where a failure to instantiate an instance for a module that defines an `externref` global will result in an invalid drop of a `VMExternRef` via an uninitialized pointer. A number of conditions listed in the GitHub Security Advisory must be true in order for an instance to be vulnerable to this issue. Maintainers believe that the effective impact of this bug is relatively small because the usage of `externref` is still uncommon and without a resource limiter configured on the `Store`, which is not the default configuration, it is only possible to trigger the bug from an error returned by `mprotect` or `VirtualAlloc`. Note that on Linux with the `uffd` feature enabled, it is only possible to trigger the bug from a resource limiter as the call to `mprotect` is skipped. • https://github.com/bytecodealliance/wasmtime/commit/886ecc562040bef61faf19438c22285c2d62403a https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-88xq-w8cq-xfg7 • CWE-824: Access of Uninitialized Pointer •
CVSS: 6.3EPSS: 0%CPEs: 3EXPL: 0CVE-2021-39218 – Out-of-bounds read/write and invalid free with `externref`s and GC safepoints in Wasmtime
https://notcve.org/view.php?id=CVE-2021-39218
Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.26.0 and before version 0.30.0 is affected by a memory unsoundness vulnerability. There was an invalid free and out-of-bounds read and write bug when running Wasm that uses `externref`s in Wasmtime. To trigger this bug, Wasmtime needs to be running Wasm that uses `externref`s, the host creates non-null `externrefs`, Wasmtime performs a garbage collection (GC), and there has to be a Wasm frame on the stack that is at a GC safepoint where there are no live references at this safepoint, and there is a safepoint with live references earlier in this frame's function. Under this scenario, Wasmtime would incorrectly use the GC stack map for the safepoint from earlier in the function instead of the empty safepoint. • https://crates.io/crates/wasmtime https://github.com/bytecodealliance/wasmtime/commit/398a73f0dd862dbe703212ebae8e34036a18c11c https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4873-36h9-wv49 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAVBRYDDUIY2ZR3K3FO4BVYJKIMJ5TP7 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2Z33FTXFQ6EOINVEQIP4DFBG53G5XIY • CWE-125: Out-of-bounds Read CWE-590: Free of Memory not on the Heap CWE-787: Out-of-bounds Write •
CVSS: 6.3EPSS: 0%CPEs: 3EXPL: 0CVE-2021-39219 – Wrong type for `Linker`-define functions when used across two `Engine`s
https://notcve.org/view.php?id=CVE-2021-39219
Wasmtime is an open source runtime for WebAssembly & WASI. Wasmtime before version 0.30.0 is affected by a type confusion vulnerability. As a Rust library the `wasmtime` crate clearly marks which functions are safe and which are `unsafe`, guaranteeing that if consumers never use `unsafe` then it should not be possible to have memory unsafety issues in their embeddings of Wasmtime. An issue was discovered in the safe API of `Linker::func_*` APIs. These APIs were previously not sound when one `Engine` was used to create the `Linker` and then a different `Engine` was used to create a `Store` and then the `Linker` was used to instantiate a module into that `Store`. • https://crates.io/crates/wasmtime https://github.com/bytecodealliance/wasmtime/commit/b39f087414f27ae40c44449ed5d1154e03449bff https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q879-9g95-56mx https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAVBRYDDUIY2ZR3K3FO4BVYJKIMJ5TP7 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2Z33FTXFQ6EOINVEQIP4DFBG53G5XIY • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •