PT-2023-28139 · Wasmtime · Wasmtime

Afonso360 · Published 2023-09-05 · Updated 2023-09-21 · CVE-2023-41880

Positive Technologies (AI Summary)

CVSS v3.1

2.2

Low

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Wasmtime versions 10.0.0 through 12.0.1

Description The issue is related to a miscompilation of the WebAssembly i64x2.shr s instruction on x86 64 platforms when the shift amount is a constant value that is larger than 32. This results in the instruction producing an incorrect result, where the low 32-bits of the second lane of the vector are derived from the low 32-bits of the second lane of the input vector instead of the high 32-bits. The primary impact is that any WebAssembly program using the i64x2.shr s with a constant shift amount larger than 32 may produce an incorrect result. This issue does not allow escape from the WebAssembly sandbox, and execution of WebAssembly guest programs will still behave correctly with respect to memory sandboxing and isolation from the host.

Recommendations To resolve the issue, update to Wasmtime version 10.0.2, 11.0.2, or 12.0.2, as these versions are patched to no longer have this miscompilation. As a temporary workaround, consider disabling the SIMD proposal for WebAssembly.

Exploit

Fix

Weakness Enumeration

CWE-193

Related Identifiers

CVE-2023-41880

GHSA-GW5P-Q8MJ-P7GH

RUSTSEC-2023-0091

Affected Products

Wasmtime

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41880.json · Exploit
• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gw5p-q8mj-p7gh · Vendor Advisory
• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gw5p-q8mj-p7gh#:~:text=Mailing%20list%20announcement · Vendor Advisory
• https://github.com/bytecodealliance/wasmtime/pull/6372 · Patch
• https://github.com/bytecodealliance/wasmtime/commit/8d7eda15b0badcbea83a7aac2d08f80788b59240 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-41880 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-41880 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-41880 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-41880 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gw5p-q8mj-p7gh · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-41880 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-41880 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2023-0091 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-41880 · Vendor Advisory
• https://github.com/bytecodealliance/wasmtime · Note