PT-2024-32801 · Wasmtime · Wasmtime

Alexcrichton · Published 2024-10-02 · Updated 2025-09-29 · CVE-2024-47763

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Wasmtime versions 21.0.0 through 21.0.1 Wasmtime versions 22.0.0 through 22.0.0 Wasmtime versions 23.0.0 through 23.0.2 Wasmtime versions 24.0.0 through 24.0.0 Wasmtime versions 25.0.0 through 25.0.1

Description The issue is related to Wasmtime's implementation of WebAssembly tail calls combined with stack traces, which can result in a runtime crash in certain WebAssembly modules. This can happen when an exported function in a WebAssembly module performs a return call (or return call indirect or return call ref) to an imported host function that captures a stack trace. The crash is due to an internal assert in the stack-walking code that raises a Rust panic!(). The impact of this issue is a denial-of-service vector where a malicious WebAssembly module or component can cause the host to crash. There is no other impact at this time other than availability of a service as the result of the crash is always a crash and no more.

Recommendations For Wasmtime versions 21.0.0 through 21.0.1, upgrade to version 21.0.2. For Wasmtime versions 22.0.0 through 22.0.0, upgrade to version 22.0.1. For Wasmtime versions 23.0.0 through 23.0.2, upgrade to version 23.0.3. For Wasmtime versions 24.0.0 through 24.0.0, upgrade to version 24.0.1. For Wasmtime versions 25.0.0 through 25.0.1, upgrade to version 25.0.2. As a temporary workaround, consider disabling tail call support in Wasmtime by setting Config::wasm tail call(false).

Exploit

Fix

DoS

Assertion Failure

Weakness Enumeration

CWE-670

CWE-617

Related Identifiers

CVE-2024-47763

GHSA-Q8HX-MM92-4WVG

PYSEC-2024-312

RUSTSEC-2024-0440

Affected Products

Wasmtime

References · 29

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47763.json · Exploit
• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q8hx-mm92-4wvg · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-47763 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-47763 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-312 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-47763 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q8hx-mm92-4wvg · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-47763 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2024-0440 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-47763 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-47763 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-47763 · Vendor Advisory
• https://github.com/bytecodealliance/wasmtime/pull/8540 · Note
• https://github.com/bytecodealliance/wasmtime/pull/8682 · Note
• https://github.com/bytecodealliance/wasmtime · Note