PT-2024-32825 · Wasmtime · Wasmtime

Fitzgen · Published 2024-10-03 · Updated 2025-09-29 · CVE-2024-47813

Positive Technologies (AI Summary)

CVSS v3.1

2.9

Low

Base vector

AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Wasmtime versions 19.0.0 through 20.0.0 Wasmtime versions 21.0.0 through 21.0.1 Wasmtime versions 22.0.0 Wasmtime versions 23.0.0 through 23.0.2 Wasmtime versions 24.0.0 Wasmtime versions 25.0.0 through 25.0.1

Description A race condition in Wasmtime's internal type registry can lead to panics and potentially type registry corruption under certain concurrent event orderings. This corruption could result in violations of WebAssembly's control-flow integrity (CFI) and type safety. Users that do not use wasmtime::Engine across multiple threads are not affected. The issue arises from a time-of-check versus time-of-use (TOCTOU) bug where one thread atomically decrements a type entry's registration count and then acquires a lock to unregister that entry, but another thread could re-register the type, resurrecting it, before the first thread acquires the lock. This double-unregistration could lead to a WebAssembly CFI violation if a new WebAssembly module is loaded into the engine before the second unregistration occurs.

Recommendations For Wasmtime versions 19.0.0 through 20.0.0, upgrade to version 21.0.2 or later. For Wasmtime versions 21.0.0 through 21.0.1, upgrade to version 21.0.2 or later. For Wasmtime versions 22.0.0, upgrade to version 22.0.1 or later. For Wasmtime versions 23.0.0 through 23.0.2, upgrade to version 23.0.3 or later. For Wasmtime versions 24.0.0, upgrade to version 24.0.1 or later. For Wasmtime versions 25.0.0 through 25.0.1, upgrade to version 25.0.2 or later. As a temporary workaround, consider avoiding the creation and dropping of Wasmtime types on multiple threads concurrently.

Exploit

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2024-47813

GHSA-7QMX-3FPX-R45M

PYSEC-2024-311

RUSTSEC-2024-0439

Affected Products

Wasmtime

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47813.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-47813 · Security Note
• https://ubuntu.com/security/CVE-2024-47813 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-47813 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2024-0439 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-47813 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-311 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-47813 · Security Note
• https://osv.dev/vulnerability/GHSA-7qmx-3fpx-r45m · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-47813 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-47813 · Vendor Advisory
• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7qmx-3fpx-r45m · Note
• https://github.com/bytecodealliance/wasmtime/pull/7969 · Note
• https://github.com/bytecodealliance/wasmtime · Note
• https://github.com/bytecodealliance/wasmtime/commit/0ebe54d05f0e1f6c64b7c8bb48c9e9f6c95cacba · Note