REDHAT-BUG-2477467: High severity Wasmtime Wasmtime vulnerability
Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked on overflow. This overflow is possible to trigger, and thus panic, when a table with an extremely large size is allocated. This is possible with the WebAssembly memory64 proposal where tables can have sizes in the 64-bit range as opposed to the previous 32-bit range which would not overflow. The panic happens when attempting to create a very large table, such as when instantiating a WebAssembly module or component. This vulnerability is fixed in 36.0.8, 43.0.2, and 44.0.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 36.0.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 43.0.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 44.0.1
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2477467?
The severity of REDHAT-BUG-2477467 is classified as high with a rating of 7.
What type of vulnerability is REDHAT-BUG-2477467?
REDHAT-BUG-2477467 is a vulnerability related to overflow in the allocation logic of WebAssembly tables within Wasmtime.
How can I fix REDHAT-BUG-2477467?
To fix REDHAT-BUG-2477467, update Wasmtime to version 36.0.9 or later.
What are the affected versions of Wasmtime for REDHAT-BUG-2477467?
The affected versions for REDHAT-BUG-2477467 range from 30.0.0 to 36.0.8, 43.0.2, and 44.0.1.
What impact does REDHAT-BUG-2477467 have on systems using Wasmtime?
REDHAT-BUG-2477467 can lead to panics when allocating extremely large tables, potentially disrupting applications that utilize WebAssembly.