CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-24791 – Use after free in Wasmtime
https://notcve.org/view.php?id=CVE-2022-24791
31 Mar 2022 — Wasmtime is a standalone JIT-style runtime for WebAssembly, using Cranelift. There is a use after free vulnerability in Wasmtime when both running Wasm that uses externrefs and enabling epoch interruption in Wasmtime. If you are not explicitly enabling epoch interruption (it is disabled by default) then you are not affected. If you are explicitly disabling the Wasm reference types proposal (it is enabled by default) then you are also not affected. The use after free is caused by Cranelift failing to emit st... • https://github.com/bytecodealliance/wasmtime/commit/666c2554ea0e1728c35aa41178cf235920db888a • CWE-416: Use After Free •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-23636 – Invalid drop of partially-initialized instances in wasmtime
https://notcve.org/view.php?id=CVE-2022-23636
16 Feb 2022 — Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.34.1 and 0.33.1, there exists a bug in the pooling instance allocator in Wasmtime's runtime where a failure to instantiate an instance for a module that defines an `externref` global will result in an invalid drop of a `VMExternRef` via an uninitialized pointer. A number of conditions listed in the GitHub Security Advisory must be true in order for an instance to be vulnerable to this issue. Maintainers believe that the effective... • https://github.com/bytecodealliance/wasmtime/commit/886ecc562040bef61faf19438c22285c2d62403a • CWE-824: Access of Uninitialized Pointer •
CVSS: 8.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-43790 – Use After Free in lucet
https://notcve.org/view.php?id=CVE-2021-43790
29 Nov 2021 — Lucet is a native WebAssembly compiler and runtime. There is a bug in the main branch of `lucet-runtime` affecting all versions published to crates.io that allows a use-after-free in an Instance object that could result in memory corruption, data race, or other related issues. This bug was introduced early in the development of Lucet and is present in all releases. As a result of this bug, and dependent on the memory backing for the Instance objects, it is possible to trigger a use-after-free when the Insta... • https://crates.io/crates/lucet-runtime • CWE-416: Use After Free •
CVSS: 6.3EPSS: 0%CPEs: 3EXPL: 0CVE-2021-39218 – Out-of-bounds read/write and invalid free with `externref`s and GC safepoints in Wasmtime
https://notcve.org/view.php?id=CVE-2021-39218
17 Sep 2021 — Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.26.0 and before version 0.30.0 is affected by a memory unsoundness vulnerability. There was an invalid free and out-of-bounds read and write bug when running Wasm that uses `externref`s in Wasmtime. To trigger this bug, Wasmtime needs to be running Wasm that uses `externref`s, the host creates non-null `externrefs`, Wasmtime performs a garbage collection (GC), and there has to be a Wasm frame on the stack that is at a GC s... • https://crates.io/crates/wasmtime • CWE-125: Out-of-bounds Read CWE-590: Free of Memory not on the Heap CWE-787: Out-of-bounds Write •
CVSS: 6.3EPSS: 0%CPEs: 3EXPL: 0CVE-2021-39219 – Wrong type for `Linker`-define functions when used across two `Engine`s
https://notcve.org/view.php?id=CVE-2021-39219
17 Sep 2021 — Wasmtime is an open source runtime for WebAssembly & WASI. Wasmtime before version 0.30.0 is affected by a type confusion vulnerability. As a Rust library the `wasmtime` crate clearly marks which functions are safe and which are `unsafe`, guaranteeing that if consumers never use `unsafe` then it should not be possible to have memory unsafety issues in their embeddings of Wasmtime. An issue was discovered in the safe API of `Linker::func_*` APIs. These APIs were previously not sound when one `Engine` was use... • https://crates.io/crates/wasmtime • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 6.3EPSS: 0%CPEs: 3EXPL: 0CVE-2021-39216 – Use after free passing `externref`s to Wasm in Wasmtime
https://notcve.org/view.php?id=CVE-2021-39216
17 Sep 2021 — Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.19.0 and before version 0.30.0 there was a use-after-free bug when passing `externref`s from the host to guest Wasm content. To trigger the bug, you have to explicitly pass multiple `externref`s from the host to a Wasm instance at the same time, either by passing multiple `externref`s as arguments from host code to a Wasm function, or returning multiple `externref`s to Wasm from a multi-value return function defined in the... • https://crates.io/crates/wasmtime • CWE-416: Use After Free •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-32629 – Memory access due to code generation flaw in Cranelift module
https://notcve.org/view.php?id=CVE-2021-32629
24 May 2021 — Cranelift is an open-source code generator maintained by Bytecode Alliance. It translates a target-independent intermediate representation into executable machine code. There is a bug in 0.73 of the Cranelift x64 backend that can create a scenario that could result in a potential sandbox escape in a Wasm program. This bug was introduced in the new backend on 2020-09-08 and first included in a release on 2020-09-30, but the new backend was not the default prior to 0.73. The recently-released version 0.73 wit... • https://crates.io/crates/cranelift-codegen • CWE-125: Out-of-bounds Read CWE-681: Incorrect Conversion between Numeric Types CWE-788: Access of Memory Location After End of Buffer •