PT-2022-16882 · Wasmtime · Wasmtime

Published 2022-03-28 · Updated 2024-06-15 · CVE-2022-24791

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wasmtime versions prior to 0.34.2 Wasmtime versions prior to 0.35.2

Description There is a use after free vulnerability in Wasmtime when both running Wasm that uses externrefs and enabling epoch interruption in Wasmtime. The use after free is caused by Cranelift failing to emit stack maps when there are safepoints inside cold blocks. Cold blocks occur when epoch interruption is enabled. When Wasmtime would eventually collect garbage, it would fail to find live references on the stack because of the missing stack maps, think that they were unreferenced garbage, and therefore reclaim them. Then after the collection ended, the Wasm code could use the reclaimed-too-early references, which is a use after free.

Recommendations For versions prior to 0.34.2, upgrade to version 0.34.2 or later. For versions prior to 0.35.2, upgrade to version 0.35.2 or later. As a temporary workaround, consider disabling the Wasm reference types proposal by setting config.wasm reference types(false). Alternatively, disable epoch interruption by setting config.epoch interruption(false) if it was previously enabled.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2022-24791

GHSA-GWC9-348X-QWV2

OPENSUSE-SU-2024:12009-1

RUSTSEC-2022-0016

RUSTSEC-2022-0099

Affected Products

Wasmtime

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24791.json · Exploit
• https://github.com/bytecodealliance/wasmtime/commit/666c2554ea0e1728c35aa41178cf235920db888a · Patch
• https://osv.dev/vulnerability/RUSTSEC-2022-0016 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-24791 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-24791 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24791 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24791 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:12009-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gwc9-348x-qwv2 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-24791 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2022-0099 · Vendor Advisory
• https://github.com/bytecodealliance/wasmtime · Note
• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gwc9-348x-qwv2 · Note
• https://github.com/WebAssembly/reference-types · Note
• https://rustsec.org/advisories/RUSTSEC-2022-0099.html · Note