Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend.
This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
Weakness Type (CWE)
References 12
https://github.com/bytecodealliance/wasmtime/commit/222ff3a65dab9aa7011f8c24693…
security-advisories@github.com
https://github.com/bytecodealliance/wasmtime/commit/994549891c8a706cb4f2809f9d1…
security-advisories@github.com
https://github.com/bytecodealliance/wasmtime/commit/e61df1b454be9313d61a5f8de07…
security-advisories@github.com
https://github.com/bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8…
security-advisories@github.com
https://github.com/bytecodealliance/wasmtime/pull/14818
security-advisories@github.com
https://github.com/bytecodealliance/wasmtime/pull/14819
security-advisories@github.com
https://github.com/bytecodealliance/wasmtime/pull/14820
security-advisories@github.com
https://github.com/bytecodealliance/wasmtime/pull/14826
security-advisories@github.com
https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.19
security-advisories@github.com
https://github.com/bytecodealliance/wasmtime/releases/tag/v48.0.7
security-advisories@github.com
https://github.com/bytecodealliance/wasmtime/releases/tag/v49.0.4
security-advisories@github.com
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp…
security-advisories@github.com