Skip to content
OpenAdvisories
Medium · 6.4 CVE-2022-31146 EUVD-2022-6243GHSA-5fhj-g3p3-pq9gRUSTSEC-2022-0100

Use After Free in Wasmtime

Published Jul 20, 2022 · Updated Apr 23, 2025 · Assigned by GitHub_M

Description

Wasmtime is a standalone runtime for WebAssembly. There is a bug in the Wasmtime's code generator, Cranelift, where functions using reference types may be incorrectly missing metadata required for runtime garbage collection. This means that if a GC happens at runtime then the GC pass will mistakenly think these functions do not have live references to GC'd values, reclaiming them and deallocating them. The function will then subsequently continue to use the values assuming they had not been GC'd, leading later to a use-after-free. This bug was introduced in the migration to the `regalloc2` register allocator that occurred in the Wasmtime 0.37.0 release on 2022-05-20. This bug has been patched and users should upgrade to Wasmtime version 0.38.2. Mitigations for this issue can be achieved by disabling the reference types proposal by passing `false` to `wasmtime::Config::wasm_reference_types` or downgrading to Wasmtime 0.36.0 or prior.

Affected products

VendorProductAffectedFixed
bytecodealliance wasmtime >= 0.37.0, < 0.38.2, >= 0.84.0, < 0.85.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS thunderbird No fix yet —
Ubuntu 22.04 LTS mozjs78 +2 No fix yet —
Ubuntu 20.04 LTS mozjs52 +1 No fix yet —
Ubuntu 18.04 LTS mozjs38 +1 No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io cranelift-codegen >= 0.84.0, < 0.85.2 0.85.2 GHSA-5fhj-g3p3-pq9g
crates.io wasmtime >= 0.37.0, < 0.38.2 0.38.2 GHSA-5fhj-g3p3-pq9g
crates.io wasmtime >= 0.0.0-0, < 0.38.2 0.38.2 RUSTSEC-2022-0100

References