CVE-2022-39394: wasmtime_trap_code C API function has out of bounds write vulnerability
Impact
There is a bug in Wasmtime's C API implementation where the definition of the wasmtimetrapcode does not match its declared signature in the wasmtime/trap.h header file. This discrepancy causes the function implementation to perform a 4-byte write into a 1-byte buffer provided by the caller. This can lead to three zero bytes being written beyond the 1-byte location provided by the caller.
Patches
This bug has been patched and users should upgrade to Wasmtime 2.0.2.
Workarounds
This can be worked around by providing a 4-byte buffer casted to a 1-byte buffer when calling wasmtimetrapcode. Users of the wasmtime crate are not affected by this issue, only users of the C API function wasmtimetrapcode are affected.
References
Definition of wasmtimetrapcode Mailing list announcement Patch to fix for main branch
For more information
If you have any questions or comments about this advisory:
Reach out to us on the Bytecode Alliance Zulip chat Open an issue in the bytecodealliance/wasmtime repository
Other sources
Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's C API implementation where the definition of the wasmtimetrapcode does not match its declared signature in the wasmtime/trap.h header file. This discrepancy causes the function implementation to perform a 4-byte write into a 1-byte buffer provided by the caller. This can lead to three zero bytes being written beyond the 1-byte location provided by the caller. This bug has been patched and users should upgrade to Wasmtime 2.0.2. This bug can be worked around by providing a 4-byte buffer casted to a 1-byte buffer when calling wasmtimetrapcode. Users of the wasmtime crate are not affected by this issue, only users of the C API function wasmtimetrapcode are affected.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-39394?
CVE-2022-39394 is a vulnerability in Wasmtime, a standalone runtime for WebAssembly, that affects versions prior to 2.0.2.
What is the severity of CVE-2022-39394?
The severity of CVE-2022-39394 is critical with a CVSS score of 9.8.
How does CVE-2022-39394 affect Wasmtime?
CVE-2022-39394 affects Wasmtime's C API implementation, causing a mismatch between the definition of the `wasmtime_trap_code` and its declared signature.
How can I fix CVE-2022-39394?
To fix CVE-2022-39394, it is recommended to upgrade to Wasmtime version 2.0.2 or later.
Where can I find more information about CVE-2022-39394?
More information about CVE-2022-39394 can be found at the following references: [Reference 1](https://github.com/bytecodealliance/wasmtime/commit/087d9d7becf7422b3f872a3bcd5d97bb7ce7ff36) and [Reference 2](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-h84q-m8rr-3v9q).