Wasmtime vulnerable to data leakage between instances in the pooling allocator (bytecodealliance wasmtime)
En bref
- Source
- NVD
- EPSS
- EPSS 0.75 % · centile 55 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- GitHub_M
- Statut NVD
- Modified
Rechercher sur…
Description
Wasmtime is a standalone runtime for WebAssembly. Prior to versions 2.0.2 and 1.0.2, there is a bug in Wasmtime's implementation of its pooling instance allocator where when a linear memory is reused for another instance the initial heap snapshot of the prior instance can be visible, erroneously to the next instance. This bug has been patched and users should upgrade to Wasmtime 2.0.2 and 1.0.2. Other mitigations include disabling the pooling allocator and disabling the `memory-init-cow`.
Faiblesses (CWE)
- CWE-226 — Informations sensibles non effacées d'une ressource avant réutilisation
- CWE-212 — Suppression incorrecte d'informations sensibles avant stockage ou transfert
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N | GitHub_M |
| CVSS 3.1 | HIGH 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N | NVD · security-advisories@github.com (Secondary) |
| CVSS 3.1 | HIGH 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2022-7455
- GCVE · GCVE-0-2022-39393
Configurations affectées (CPE NVD)
cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:*< 1.0.2cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:*≥ 2.0.0 < 2.0.2
Produits affectés
| Produit | Versions |
|---|---|
| bytecodealliance · wasmtime | affected >= 2.0.0, < 2.0.2 ; affected < 1.0.2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |