PT-2024-23309 · Wasmtime · Wasmtime

Shinwonho · Published 2024-04-02 · Updated 2025-09-02 · CVE-2024-30266

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Wasmtime version 19.0.0

Description The issue is related to a regression in Wasmtime that can cause a panic in the host runtime when a guest WebAssembly module is executed. This panic occurs when a WebAssembly module issues a table.* instruction using a dropped element segment with a table that also has an externref type, causing Wasmtime to use an empty function segment instead of an empty externref segment. The panic requires the reference-types WebAssembly feature to be enabled, which is enabled by default. This issue represents a possible denial-of-service in some scenarios but does not introduce memory unsafety or allow WebAssembly to break outside of its sandbox.

Recommendations For Wasmtime version 19.0.0, upgrade to version 19.0.1 to fix the issue. As a temporary workaround, consider using config.reference types(false) to disable the reference-types feature at validation-time, which prevents the possibility of a panic at runtime.

Exploit

Fix

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

CVE-2024-30266

GHSA-75HQ-H6G9-H4Q5

RUSTSEC-2024-0441

Affected Products

Wasmtime

References · 19

• 🔥 https://github.com/bytecodealliance/wasmtime/issues/8281 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/30xxx/CVE-2024-30266.json · Exploit
• https://github.com/bytecodealliance/wasmtime/commit/7f57d0bb0948fa56cc950278d0db230ed10e8664 · Patch
• https://github.com/bytecodealliance/wasmtime/pull/8283 · Patch
• https://github.com/bytecodealliance/wasmtime/pull/8018 · Patch
• https://cve.org/CVERecord?id=CVE-2024-30266 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-30266 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-30266 · Security Note
• https://osv.dev/vulnerability/CVE-2024-30266 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-30266 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-30266 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-75hq-h6g9-h4q5 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2024-0441 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-30266 · Vendor Advisory
• https://github.com/bytecodealliance/wasmtime · Note