PT-2020-17491 · Fastly · Lucet-Runtime-Internals

Published 2020-01-24 · Updated 2021-08-25 · CVE-2020-35859

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions lucet-runtime-internals versions prior to 0.5.1

Description The issue is related to the mishandling of sigstack allocation in the lucet-runtime-internals crate. This can potentially allow guest programs to obtain sensitive information or experience memory corruption. An embedding using affected versions of lucet-runtime, configured to use non-default Wasm globals sizes of more than 4KiB, or compiled in debug mode without optimizations, could leak data from the signal handler stack to guest programs.

Recommendations For versions prior to 0.5.1, update to version 0.5.1 or later to resolve the issue by correcting the sigstack allocation logic. As a temporary workaround, consider avoiding the use of non-default Wasm globals sizes of more than 4KiB and compiling in release mode with optimizations to minimize the risk of exploitation.

Fix

Out of bounds Read

Memory Corruption

Weakness Enumeration

CWE-125

CWE-787

Related Identifiers

CVE-2020-35859

GHSA-3933-WVJF-PCVC

RUSTSEC-2020-0004

Affected Products

Lucet-Runtime-Internals

References · 9

• https://rustsec.org/advisories/RUSTSEC-2020-0004.html · Patch
• https://osv.dev/vulnerability/CVE-2020-35859 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3933-wvjf-pcvc · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2020-0004 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35859 · Security Note
• https://github.com/fastly/lucet · Note
• https://github.com/bytecodealliance/lucet/pull/401 · Note
• https://crates.io/crates/lucet-runtime-internals · Note
• https://t.me/cvenotify/8017 · Telegram Post