PT-2022-24952 · Wasmtime · Wasmtime

Alexcrichton · Published 2022-11-05 · Updated 2025-05-02 · CVE-2022-39393

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Wasmtime versions prior to 2.0.2

Description There is a bug in Wasmtime's implementation of its pooling instance allocator where when a linear memory is reused for another instance, the initial heap snapshot of the prior instance can be visible, erroneously to the next instance. This bug occurs when a slot in the pooling allocator previously was used for a module with a heap image, and the next instantiation within that slot does not itself contain a heap image. The bug is highly unlikely to be accidentally triggered and would otherwise require an intentional trigger with a hand-crafted module. In practice, modules must be deliberately crafted to not have an initial heap image to view the contents of a prior image.

Recommendations To resolve the issue, upgrade to Wasmtime 2.0.2. As a temporary workaround, consider disabling the pooling allocator. Additionally, disabling the memory-init-cow feature can mitigate the issue.

Exploit

Fix

Weakness Enumeration

CWE-226

CWE-212

Related Identifiers

CVE-2022-39393

GHSA-WH6W-3828-G9QF

RUSTSEC-2022-0075

RUSTSEC-2022-0098

Affected Products

Wasmtime

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39393.json · Exploit
• https://github.com/bytecodealliance/wasmtime/commit/2614f2e9d2d36805ead8a8da0fa0c6e0d9e428a0 · Patch
• https://ubuntu.com/security/CVE-2022-39393 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2022-0075 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-39393 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-39393 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2022-0098 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39393 · Security Note
• https://osv.dev/vulnerability/GHSA-wh6w-3828-g9qf · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-39393 · Security Note
• https://github.com/bytecodealliance/wasmtime · Note
• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wh6w-3828-g9qf · Note
• https://github.com/bytecodealliance/wasmtime/commit/3535acbf3be032ef1ba0b469b8ab92538a8a18a6 · Note
• https://rustsec.org/advisories/RUSTSEC-2022-0075.html · Note
• https://crates.io/crates/wasmtime · Note