Skip to content
OpenAdvisories

Package · crates.io

cranelift-codegen

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • Critical 10.0
    CVE-2023-26489

    Guest-controlled out-of-bounds read/write on x86_64 in wasmtime

    wasmtime is a fast and secure runtime for WebAssembly. In affected versions wasmtime's code generator, Cranelift, has a bug on x86_64 targets where address-mode computation mistakenly would calculate a 35-bit effective address instead of WebAssembly's defined…

    bytecodealliance wasmtime wasmtime cranelift-codegen crates.io
  • Low 3.1
    CVE-2023-27477

    wasmtime vulnerable to miscompilation of `i8x16.select` with the same inputs on x86_64

    wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's code generation backend, Cranelift, has a bug on x86_64 platforms for the WebAssembly `i8x16.select` instruction which will produce the wrong results when the same operand is provided to the in…

    bytecodealliance wasmtime wasmtime cranelift-codegen crates.io
  • Medium 6.4
    CVE-2022-31146

    Use After Free in Wasmtime

    Wasmtime is a standalone runtime for WebAssembly. There is a bug in the Wasmtime's code generator, Cranelift, where functions using reference types may be incorrectly missing metadata required for runtime garbage collection. This means that if a GC happens at…

    bytecodealliance wasmtime thunderbird mozjs38 Ubuntu crates.io
  • Medium 4.8
    CVE-2022-31104

    Miscompilation of `i8x16.swizzle` and `select` with v128 inputs in Wasmtime

    Wasmtime is a standalone runtime for WebAssembly. In affected versions wasmtime's implementation of the SIMD proposal for WebAssembly on x86_64 contained two distinct bugs in the instruction lowerings implemented in Cranelift. The aarch64 implementation of th…

    bytecodealliance wasmtime wasmtime cranelift-codegen crates.io
  • Medium 5.1
    CVE-2022-23636 Public exploit

    Invalid drop of partially-initialized instances in wasmtime

    Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.34.1 and 0.33.1, there exists a bug in the pooling instance allocator in Wasmtime's runtime where a failure to instantiate an instance for a module that defines an `externref` glob…

    bytecodealliance wasmtime wasmtime cranelift-codegen crates.io
  • High 7.2
    CVE-2021-32629

    Memory access due to code generation flaw in Cranelift module

    Cranelift is an open-source code generator maintained by Bytecode Alliance. It translates a target-independent intermediate representation into executable machine code. There is a bug in 0.73 of the Cranelift x64 backend that can create a scenario that could …

    bytecodealliance wasmtime cranelift-codegen wasmtime PyPI crates.io