PT-2023-21154 · Wasmtime · Wasmtime

Afonso360 · Published 2023-03-03 · Updated 2023-03-15 · CVE-2023-27477

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions wasmtime versions prior to 4.0.1 wasmtime versions prior to 5.0.1 wasmtime versions prior to 6.0.1

Description The code generation backend, Cranelift, has a bug on x86 64 platforms for the WebAssembly i8x16.select instruction which will produce the wrong results when the same operand is provided to the instruction and some of the selected indices are greater than 16. There is an off-by-one error in the calculation of the mask to the pshufb instruction which causes incorrect results to be returned if lanes are selected from the second vector. This bug may cause guest programs to behave unexpectedly due to the incorrect result of this instruction. In extreme cases, if a guest program is handling untrusted input, then the guest program may deviate from its intended execution.

Recommendations For versions prior to 4.0.1, upgrade to version 4.0.1 or later. For versions prior to 5.0.1, upgrade to version 5.0.1 or later. For versions prior to 6.0.1, upgrade to version 6.0.1 or later. As a temporary workaround, consider disabling the Wasm simd proposal by setting config.wasm simd to false.

Exploit

Fix

Weakness Enumeration

CWE-193

Related Identifiers

AZL-25857

CVE-2023-27477

GHSA-XM67-587Q-R2VW

RUSTSEC-2023-0093

Affected Products

Wasmtime

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27477.json · Exploit
• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-xm67-587q-r2vw · Vendor Advisory
• https://github.com/bytecodealliance/wasmtime/commit/5dc2bbccbb363e474d2c9a1b8e38a89a43bbd5d1 · Patch
• https://osv.dev/vulnerability/GHSA-xm67-587q-r2vw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27477 · Security Note
• https://groups.google.com/a/bytecodealliance.org/g/sec-announce/c/Mov-ItrNJsQ · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2023-0093 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-27477 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-25857 · Vendor Advisory
• https://github.com/bytecodealliance/wasmtime · Note
• https://github.com/webassembly/simd · Note
• https://t.me/cvenotify/45823 · Telegram Post
• https://rustsec.org/advisories/RUSTSEC-2023-0093.html · Note
• https://crates.io/crates/wasmtime · Note
• https://t.me/cibsecurity/59702 · Telegram Post