CVE-2024-51745: Wasmtime doesn't fully sandbox all the Windows device filenames
Impact
Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however it did not block access to the special device filenames which use superscript digits, such as "COM¹", "COM²", "LPT⁰", "LPT¹", and so on. Untrusted Wasm programs that are given access to any filesystem directory could bypass the sandbox and access devices through those special device filenames with superscript digits, and through them gain access peripheral devices connected to the computer, or network resources mapped to those devices. This can include modems, printers, network printers, and any other device connected to a serial or parallel port, including emulated USB serial ports.
Patches
Patch releases for Wasmtime have been issued as 24.0.2, 25.0.3, and 26.0.1. Users of Wasmtime 23.0.x and prior are recommended to upgrade to one of these patched versions.
Workarounds
There are no known workarounds for this issue. Affected Windows users are recommended to upgrade.
References
- Microsoft's documentation of the special device filenames - ISO-8859-1 - The original PR reporting the issue
Other sources
Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however it did not block access to the special device filenames which use superscript digits, such as "COM¹", "COM²", "LPT⁰", "LPT¹", and so on. Untrusted Wasm programs that are given access to any filesystem directory could bypass the sandbox and access devices through those special device filenames with superscript digits, and through them gain access peripheral devices connected to the computer, or network resources mapped to those devices. This can include modems, printers, network printers, and any other device connected to a serial or parallel port, including emulated USB serial ports. Patch releases for Wasmtime have been issued as 24.0.2, 25.0.3, and 26.0.1. Users of Wasmtime 23.0.x and prior are recommended to upgrade to one of these patched versions. There are no known workarounds for this issue. Affected Windows users are recommended to upgrade.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-51745?
The CVE-2024-51745 vulnerability is considered high because it can potentially allow unauthorized access to system resources.
How do I fix CVE-2024-51745?
To mitigate CVE-2024-51745, upgrade to Wasmtime version 26.0.1 or later, or version 25.0.3 for compatible releases.
Which versions of Wasmtime are affected by CVE-2024-51745?
CVE-2024-51745 affects Wasmtime versions prior to 26.0.1, versions between 25.0.0 and 25.0.3, and versions up to 24.0.2.
Is CVE-2024-51745 specific to any operating system?
Yes, CVE-2024-51745 is specifically related to the filesystem sandbox implementation of Wasmtime on Windows.
What types of device filenames can be exploited in CVE-2024-51745?
CVE-2024-51745 can be exploited using special device filenames with superscript digits, such as COM¹ and LPT⁰.