CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2022-39394 – wasmtime_trap_code C API function has out of bounds write vulnerability
https://notcve.org/view.php?id=CVE-2022-39394
10 Nov 2022 — Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's C API implementation where the definition of the `wasmtime_trap_code` does not match its declared signature in the `wasmtime/trap.h` header file. This discrepancy causes the function implementation to perform a 4-byte write into a 1-byte buffer provided by the caller. This can lead to three zero bytes being written beyond the 1-byte location provided by the caller. This bug has been patched and users shoul... • https://github.com/bytecodealliance/wasmtime/commit/087d9d7becf7422b3f872a3bcd5d97bb7ce7ff36 • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-31169 – Cranelift vulnerable to miscompilation of constant values in division on AArch64
https://notcve.org/view.php?id=CVE-2022-31169
21 Jul 2022 — Wasmtime is a standalone runtime for WebAssembly. There is a bug in Wasmtime's code generator, Cranelift, for AArch64 targets where constant divisors can result in incorrect division results at runtime. This affects Wasmtime prior to version 0.38.2 and Cranelift prior to 0.85.2. This issue only affects the AArch64 platform. Other platforms are not affected. • https://github.com/bytecodealliance/wasmtime/commit/2ba4bce5cc719e5a74e571a534424614e62ecc41 • CWE-682: Incorrect Calculation •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 0CVE-2022-31146 – Use After Free in Wasmtime
https://notcve.org/view.php?id=CVE-2022-31146
20 Jul 2022 — Wasmtime is a standalone runtime for WebAssembly. There is a bug in the Wasmtime's code generator, Cranelift, where functions using reference types may be incorrectly missing metadata required for runtime garbage collection. This means that if a GC happens at runtime then the GC pass will mistakenly think these functions do not have live references to GC'd values, reclaiming them and deallocating them. The function will then subsequently continue to use the values assuming they had not been GC'd, leading la... • https://github.com/WebAssembly/reference-types • CWE-416: Use After Free •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-31104 – Miscompilation of `i8x16.swizzle` and `select` with v128 inputs in Wasmtime
https://notcve.org/view.php?id=CVE-2022-31104
27 Jun 2022 — Wasmtime is a standalone runtime for WebAssembly. In affected versions wasmtime's implementation of the SIMD proposal for WebAssembly on x86_64 contained two distinct bugs in the instruction lowerings implemented in Cranelift. The aarch64 implementation of the simd proposal is not affected. The bugs were presented in the `i8x16.swizzle` and `select` WebAssembly instructions. The `select` instruction is only affected when the inputs are of `v128` type. • https://docs.rs/wasmtime/latest/wasmtime/struct.Config.html#method.wasm_simd • CWE-682: Incorrect Calculation •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-24791 – Use after free in Wasmtime
https://notcve.org/view.php?id=CVE-2022-24791
31 Mar 2022 — Wasmtime is a standalone JIT-style runtime for WebAssembly, using Cranelift. There is a use after free vulnerability in Wasmtime when both running Wasm that uses externrefs and enabling epoch interruption in Wasmtime. If you are not explicitly enabling epoch interruption (it is disabled by default) then you are not affected. If you are explicitly disabling the Wasm reference types proposal (it is enabled by default) then you are also not affected. The use after free is caused by Cranelift failing to emit st... • https://github.com/bytecodealliance/wasmtime/commit/666c2554ea0e1728c35aa41178cf235920db888a • CWE-416: Use After Free •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-23636 – Invalid drop of partially-initialized instances in wasmtime
https://notcve.org/view.php?id=CVE-2022-23636
16 Feb 2022 — Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.34.1 and 0.33.1, there exists a bug in the pooling instance allocator in Wasmtime's runtime where a failure to instantiate an instance for a module that defines an `externref` global will result in an invalid drop of a `VMExternRef` via an uninitialized pointer. A number of conditions listed in the GitHub Security Advisory must be true in order for an instance to be vulnerable to this issue. Maintainers believe that the effective... • https://github.com/bytecodealliance/wasmtime/commit/886ecc562040bef61faf19438c22285c2d62403a • CWE-824: Access of Uninitialized Pointer •
CVSS: 6.3EPSS: 0%CPEs: 3EXPL: 0CVE-2021-39218 – Out-of-bounds read/write and invalid free with `externref`s and GC safepoints in Wasmtime
https://notcve.org/view.php?id=CVE-2021-39218
17 Sep 2021 — Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.26.0 and before version 0.30.0 is affected by a memory unsoundness vulnerability. There was an invalid free and out-of-bounds read and write bug when running Wasm that uses `externref`s in Wasmtime. To trigger this bug, Wasmtime needs to be running Wasm that uses `externref`s, the host creates non-null `externrefs`, Wasmtime performs a garbage collection (GC), and there has to be a Wasm frame on the stack that is at a GC s... • https://crates.io/crates/wasmtime • CWE-125: Out-of-bounds Read CWE-590: Free of Memory not on the Heap CWE-787: Out-of-bounds Write •
CVSS: 6.3EPSS: 0%CPEs: 3EXPL: 0CVE-2021-39219 – Wrong type for `Linker`-define functions when used across two `Engine`s
https://notcve.org/view.php?id=CVE-2021-39219
17 Sep 2021 — Wasmtime is an open source runtime for WebAssembly & WASI. Wasmtime before version 0.30.0 is affected by a type confusion vulnerability. As a Rust library the `wasmtime` crate clearly marks which functions are safe and which are `unsafe`, guaranteeing that if consumers never use `unsafe` then it should not be possible to have memory unsafety issues in their embeddings of Wasmtime. An issue was discovered in the safe API of `Linker::func_*` APIs. These APIs were previously not sound when one `Engine` was use... • https://crates.io/crates/wasmtime • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 6.3EPSS: 0%CPEs: 3EXPL: 0CVE-2021-39216 – Use after free passing `externref`s to Wasm in Wasmtime
https://notcve.org/view.php?id=CVE-2021-39216
17 Sep 2021 — Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.19.0 and before version 0.30.0 there was a use-after-free bug when passing `externref`s from the host to guest Wasm content. To trigger the bug, you have to explicitly pass multiple `externref`s from the host to a Wasm instance at the same time, either by passing multiple `externref`s as arguments from host code to a Wasm function, or returning multiple `externref`s to Wasm from a multi-value return function defined in the... • https://crates.io/crates/wasmtime • CWE-416: Use After Free •