Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, On x86-64 platforms with SSE3 disabled Wasmtime's compilation of the f64x2.splat WebAssembly instruction with Cranelift may load 8 more bytes than is necessary. When signals-based-traps are disabled this can result in a uncaught segfault due to loading from unmapped guard pages. With guard pages disabled it's possible for out-of-sandbox data to be loaded, but this data is not visible to WebAssembly guests. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.

N/A

未捕获的异常

wasmtime 安全漏洞

wasmtime是Bytecode Alliance开源的一个轻量级WebAssembly运行时。 Wasmtime 24.0.7之前版本、36.0.7之前版本、42.0.2之前版本和43.0.1之前版本存在安全漏洞，该漏洞源于在禁用SSE3的x86-64平台上，Wasmtime使用Cranelift编译f64x2.splat WebAssembly指令时可能加载超出必要的8个字节，在禁用基于信号的陷阱时可能导致未捕获的段错误，在禁用保护页时可能加载沙箱外数据，但该数据对WebAssembly访客不可见。

N/A

N/A