wasmtime

46 results · Clear filters · Feed

• Medium 6.4
  CVE-2022-31146

  Use After Free in Wasmtime

  Wasmtime is a standalone runtime for WebAssembly. There is a bug in the Wasmtime's code generator, Cranelift, where functions using reference types may be incorrectly missing metadata required for runtime garbage collection. This means that if a GC happens at…

  bytecodealliance wasmtime thunderbird mozjs38 Ubuntu crates.io
  Jul 20, 2022
• Medium 4.8
  CVE-2022-31104

  Miscompilation of `i8x16.swizzle` and `select` with v128 inputs in Wasmtime

  Wasmtime is a standalone runtime for WebAssembly. In affected versions wasmtime's implementation of the SIMD proposal for WebAssembly on x86_64 contained two distinct bugs in the instruction lowerings implemented in Cranelift. The aarch64 implementation of th…

  bytecodealliance wasmtime wasmtime cranelift-codegen crates.io
  Jun 27, 2022
• Medium 5.1
  CVE-2022-23636 Public exploit

  Invalid drop of partially-initialized instances in wasmtime

  Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.34.1 and 0.33.1, there exists a bug in the pooling instance allocator in Wasmtime's runtime where a failure to instantiate an instance for a module that defines an `externref` glob…

  bytecodealliance wasmtime wasmtime cranelift-codegen crates.io
  Feb 16, 2022
• Medium 6.3
  CVE-2021-39218

  Out-of-bounds read/write and invalid free with `externref`s and GC safepoints in Wasmtime

  Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.26.0 and before version 0.30.0 is affected by a memory unsoundness vulnerability. There was an invalid free and out-of-bounds read and write bug when running Wasm that uses …

  bytecodealliance wasmtime
  Sep 17, 2021
• Medium 6.3
  CVE-2021-39219

  Wrong type for `Linker`-define functions when used across two `Engine`s

  Wasmtime is an open source runtime for WebAssembly & WASI. Wasmtime before version 0.30.0 is affected by a type confusion vulnerability. As a Rust library the `wasmtime` crate clearly marks which functions are safe and which are `unsafe`, guaranteeing that if…

  bytecodealliance wasmtime
  Sep 17, 2021
• Medium 6.3
  CVE-2021-39216

  Use after free passing `externref`s to Wasm in Wasmtime

  Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.19.0 and before version 0.30.0 there was a use-after-free bug when passing `externref`s from the host to guest Wasm content. To trigger the bug, you have to explicitly pass …

  bytecodealliance wasmtime wasmtime wasmtime PyPI crates.io
  Sep 17, 2021