Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64
Vulnerability Description
Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, On x86-64 platforms with SSE3 disabled Wasmtime's compilation of the f64x2.splat WebAssembly instruction with Cranelift may load 8 more bytes than is necessary. When signals-based-traps are disabled this can result in a uncaught segfault due to loading from unmapped guard pages. With guard pages disabled it's possible for out-of-sandbox data to be loaded, but this data is not visible to WebAssembly guests. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.
CVSS Information
N/A
Vulnerability Type
未捕获的异常
Vulnerability Title
wasmtime 安全漏洞
Vulnerability Description
wasmtime是Bytecode Alliance开源的一个轻量级WebAssembly运行时。 Wasmtime 24.0.7之前版本、36.0.7之前版本、42.0.2之前版本和43.0.1之前版本存在安全漏洞，该漏洞源于在禁用SSE3的x86-64平台上，Wasmtime使用Cranelift编译f64x2.splat WebAssembly指令时可能加载超出必要的8个字节，在禁用基于信号的陷阱时可能导致未捕获的段错误，在禁用保护页时可能加载沙箱外数据，但该数据对WebAssembly访客不可见。
CVSS Information
N/A
Vulnerability Type
N/A