Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2022-24791— Use after free in Wasmtime

Quick assessment

Affected
bytecodealliance wasmtime
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Wasmtime是一个字节码联盟项目，它是一个独立的仅用于 WebAssembly 和 WASI 的 wasm 优化运行时。 Wasmtime 存在资源管理错误漏洞，该漏洞源于当运行使用 externrefs 的 Wasm 并在 Wasmtime 中启用 epoch 中断时，Wasmtime 中有一个 use after free 漏洞。以下产品和版本受到影响：0.34.0、0.34.1、0.35.0 和 0.35.1。

CVSS 8.1 · High EPSS 1.18% · P67

Possible ATT&CK Techniques 1 AI

T1203 · Exploitation for Client Execution
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2022-24791

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Use after free in Wasmtime
Source: CVE Program / CVE List V5
Vulnerability Description
Wasmtime is a standalone JIT-style runtime for WebAssembly, using Cranelift. There is a use after free vulnerability in Wasmtime when both running Wasm that uses externrefs and enabling epoch interruption in Wasmtime. If you are not explicitly enabling epoch interruption (it is disabled by default) then you are not affected. If you are explicitly disabling the Wasm reference types proposal (it is enabled by default) then you are also not affected. The use after free is caused by Cranelift failing to emit stack maps when there are safepoints inside cold blocks. Cold blocks occur when epoch interruption is enabled. Cold blocks are emitted at the end of compiled functions, and change the order blocks are emitted versus defined. This reordering accidentally caused Cranelift to skip emitting some stack maps because it expected to emit the stack maps in block definition order, rather than block emission order. When Wasmtime would eventually collect garbage, it would fail to find live references on the stack because of the missing stack maps, think that they were unreferenced garbage, and therefore reclaim them. Then after the collection ended, the Wasm code could use the reclaimed-too-early references, which is a use after free. Patches have been released in versions 0.34.2 and 0.35.2, which fix the vulnerability. All Wasmtime users are recommended to upgrade to these patched versions. If upgrading is not an option for you at this time, you can avoid the vulnerability by either: disabling the Wasm reference types proposal, config.wasm_reference_types(false); or by disabling epoch interruption if you were previously enabling it. config.epoch_interruption(false).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
释放后使用
Source: CVE Program / CVE List V5
Vulnerability Title
Wasmtime 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Wasmtime是一个字节码联盟项目，它是一个独立的仅用于 WebAssembly 和 WASI 的 wasm 优化运行时。 Wasmtime 存在资源管理错误漏洞，该漏洞源于当运行使用 externrefs 的 Wasm 并在 Wasmtime 中启用 epoch 中断时，Wasmtime 中有一个 use after free 漏洞。以下产品和版本受到影响：0.34.0、0.34.1、0.35.0 和 0.35.1。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
bytecodealliance wasmtime < 0.34.2 -

II. Public POCs for CVE-2022-24791

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-24791

请登录查看更多情报信息。

Patches & Fixes for CVE-2022-24791 (1)

Vendor Advisories for CVE-2022-24791 (1)

IV. Related Vulnerabilities

Same product: wasmtime
Same vendor: bytecodealliance
Same weakness: CWE-416

V. Comments for CVE-2022-24791

No comments yet

Leave a comment