Reported

September 17, 2021

Issued

September 17, 2021 (last modified: June 13, 2023)

Package

wasmtime (crates.io)

Type

Vulnerability

Categories

• memory-corruption
• memory-exposure

Keywords

#use-after-free #out-of-bounds-read #out-of-bounds-write #Wasm #garbage-collection

Aliases

• CVE-2021-39216
• CVE-2021-39218
• CVE-2021-39219
• GHSA-4873-36h9-wv49
• GHSA-q879-9g95-56mx
• GHSA-v4cp-h94r-m7xf

References

• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-v4cp-h94r-m7xf
• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4873-36h9-wv49
• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q879-9g95-56mx

CVSS Score

6.3 MEDIUM

CVSS Details

Attack vector

Local

Attack complexity

High

Privileges required

Low

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

CVSS Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

Patched

• >=0.30.0

Affected Functions

Version

wasmtime::Linker::func_new

• <0.30.0

wasmtime::Linker::func_wrap

• <0.30.0

wasmtime::Store::gc

• <0.30.0

Description

• Use after free passing externrefs to Wasm in Wasmtime

• Out-of-bounds read/write and invalid free with externrefs and GC safepoints in Wasmtime

• Wrong type for Linker-define functions when used across two Engines

Advisory available under CC0-1.0 license.