CVSS: 8.6EPSS: 0%CPEs: 2EXPL: 0CVE-2022-39393 – Wasmtime vulnerable to data leakage between instances in the pooling allocator
https://notcve.org/view.php?id=CVE-2022-39393
Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's implementation of its pooling instance allocator where when a linear memory is reused for another instance the initial heap snapshot of the prior instance can be visible, erroneously to the next instance. This bug has been patched and users should upgrade to Wasmtime 2.0.2. Other mitigations include disabling the pooling allocator and disabling the `memory-init-cow`. Wasmtime es una ejecución independiente de WebAssembly. • https://github.com/bytecodealliance/wasmtime/commit/2614f2e9d2d36805ead8a8da0fa0c6e0d9e428a0 https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wh6w-3828-g9qf • CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer CWE-226: Sensitive Information in Resource Not Removed Before Reuse •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-31169 – Cranelift vulnerable to miscompilation of constant values in division on AArch64
https://notcve.org/view.php?id=CVE-2022-31169
Wasmtime is a standalone runtime for WebAssembly. There is a bug in Wasmtime's code generator, Cranelift, for AArch64 targets where constant divisors can result in incorrect division results at runtime. This affects Wasmtime prior to version 0.38.2 and Cranelift prior to 0.85.2. This issue only affects the AArch64 platform. Other platforms are not affected. • https://github.com/bytecodealliance/wasmtime/commit/2ba4bce5cc719e5a74e571a534424614e62ecc41 https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7f6x-jwh5-m9r4 • CWE-682: Incorrect Calculation •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-31146 – Use After Free in Wasmtime
https://notcve.org/view.php?id=CVE-2022-31146
Wasmtime is a standalone runtime for WebAssembly. There is a bug in the Wasmtime's code generator, Cranelift, where functions using reference types may be incorrectly missing metadata required for runtime garbage collection. This means that if a GC happens at runtime then the GC pass will mistakenly think these functions do not have live references to GC'd values, reclaiming them and deallocating them. The function will then subsequently continue to use the values assuming they had not been GC'd, leading later to a use-after-free. This bug was introduced in the migration to the `regalloc2` register allocator that occurred in the Wasmtime 0.37.0 release on 2022-05-20. • https://github.com/WebAssembly/reference-types https://github.com/bytecodealliance/wasmtime https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5fhj-g3p3-pq9g • CWE-416: Use After Free •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-31104 – Miscompilation of `i8x16.swizzle` and `select` with v128 inputs in Wasmtime
https://notcve.org/view.php?id=CVE-2022-31104
Wasmtime is a standalone runtime for WebAssembly. In affected versions wasmtime's implementation of the SIMD proposal for WebAssembly on x86_64 contained two distinct bugs in the instruction lowerings implemented in Cranelift. The aarch64 implementation of the simd proposal is not affected. The bugs were presented in the `i8x16.swizzle` and `select` WebAssembly instructions. The `select` instruction is only affected when the inputs are of `v128` type. • https://docs.rs/wasmtime/latest/wasmtime/struct.Config.html#method.wasm_simd https://github.com/bytecodealliance/wasmtime/pull/4317 https://github.com/bytecodealliance/wasmtime/pull/4318 https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqwc-c49r-4w2x https://github.com/webassembly/simd https://webassembly.github.io/spec • CWE-682: Incorrect Calculation •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-24791 – Use after free in Wasmtime
https://notcve.org/view.php?id=CVE-2022-24791
Wasmtime is a standalone JIT-style runtime for WebAssembly, using Cranelift. There is a use after free vulnerability in Wasmtime when both running Wasm that uses externrefs and enabling epoch interruption in Wasmtime. If you are not explicitly enabling epoch interruption (it is disabled by default) then you are not affected. If you are explicitly disabling the Wasm reference types proposal (it is enabled by default) then you are also not affected. The use after free is caused by Cranelift failing to emit stack maps when there are safepoints inside cold blocks. • https://github.com/bytecodealliance/wasmtime/commit/666c2554ea0e1728c35aa41178cf235920db888a https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gwc9-348x-qwv2 • CWE-416: Use After Free •