Impact

Wasmtime's code generator, Cranelift, has a bug on x8664 targets where address-mode computation mistakenly would calculate a 35-bit effective address instead of WebAssembly's defined 33-bit effective address. This bug means that, with default codegen settings, a wasm-controlled load/store operation could read/write addresses up to 35 bits away from the base of linear memory. Wasmtime's default sandbox settings provide up to 6G of protection from the base of linear memory to guarantee that any memory access in that range will be semantically correct. Due to this bug, however, addresses up to 0xffffffff 8 + 0x7ffffffc = 36507222004 = ~34G bytes away from the base of linear memory are possible from guest code. This means that the virtual memory 6G away from the base of linear memory up to ~34G away can be read/written by a malicious module.

This out of bounds read/write is not semantically correct and poses a threat as an arbitrary read/write within ~34G of linear memory away from the base of a wasm module's linear memory. A guest module can, without the knowledge of the embedder, read/write memory in this region. The memory may belong to other WebAssembly instances when using the pooling allocator, for example. The memory may also belong to the embedder, depending on address layout.

Embedders do not have a necessarily reliable means of detecting when this happens. Wasm loads/stores are allowed to cause machine segfaults meaning that an invalid read/write would be translated to a nominal WebAssembly trap. This means that a malicious module in the worst case silently reads/writes memory outside its bounds and in the "best" case looks like a normal "something trapped here" during its execution. This makes it difficult to retroactively determine whether this bug has been exploited on hosts. Affected embedders are recommended to analyze preexisting wasm modules to see if they're affected by the incorrect codegen rules and possibly correlate that with an anomalous number of traps during historical execution to locate possibly suspicious modules.

The specific bug in Cranelift's x8664 backend is that a WebAssembly address which is left-shifted by a constant amount from 1 to 3 will get folded into x8664's addressing modes which perform shifts. For example (i32.load (i32.shl (local.get 0) (i32.const 3))) loads from the WebAssembly address $local0 << 3. When translated to Cranelift the $local0 << 3 computation, a 32-bit value, is zero-extended to a 64-bit value and then added to the base address of linear memory. Cranelift would generate an instruction of the form movl (%base, %local0, 8), %dst which calculates %base + %local0 << 3. The bug here, however, is that the address computation happens with 64-bit values, where the $local0 << 3 computation was supposed to be truncated to a 32-bit value. This means that %local0, which can use up to 32-bits for an address, gets 3 extra bits of address space to be accessible via this movl instruction.

The fix in Cranelift is to remove the erroneous lowering rules in the backend which handle these zero-extended expressions. The above example is then translated to movl %local0, %temp; shl $3, %temp; movl (%base, %temp), %dst which correctly truncates the intermediate computation of %local0 << 3 to 32-bits inside the %temp register which is then added to the %base value.

Patches

Wasmtime version 4.0.1, 5.0.1, and 6.0.1 have been released and have all been patched to no longer contain the erroneous lowering rules.

Workarounds

While updating Wasmtime is recommended, there are a number of possible workarounds that embedders can employ to mitigate this issue if updating is not possible. Note that none of these workarounds are on-by-default and require explicit configuration:

The Config::staticmemorymaximumsize(0) option can be used to force all accesses to linear memory to be explicitly bounds-checked. This will perform a bounds check separately from the address-mode computation which correctly calculates the effective address of a load/store. Note that this can have a large impact on the execution performance of WebAssembly modules. The Config::staticmemoryguardsize(1 << 36) option can be used to greatly increase the guard pages placed after linear memory. This will guarantee that memory accesses up-to-34G away are guaranteed to be semantically correct by reserving unmapped memory for the instance. Note that this reserves a very large amount of virtual memory per-instances and can greatly reduce the maximum number of concurrent instances being run. If using a non-x8664 host is possible, then that will also work around this bug. This bug does not affect Wasmtime's or Cranelift's AArch64 backend, for example.

References

Config::staticmemorymaximumsize Config::staticmemoryguardsize Mailing list announcement GitHub advisory Commit to fix this issue on Wasmtime's main branch

For more information

If you have any questions or comments about this advisory:

Reach out to us on the Bytecode Alliance Zulip chat Open an issue in the bytecodealliance/wasmtime repository

Impact

Wasmtime's code generation backend, Cranelift, has a bug on x8664 platforms for the WebAssembly i8x16.select instruction which will produce the wrong results when the same operand is provided to the instruction and some of the selected indices are greater than 16. There is an off-by-one error in the calculation of the mask to the pshufb instruction which causes incorrect results to be returned if lanes are selected from the second vector.

The impact of this miscompilation is that the WebAssembly instruction can produce incorrect results for the i8x16.select instruction. This should have no effect on embedders and does not represent a sandbox escape, for example. Guest programs, however, may behave unexpectedly due to the incorrect result of this instruction. In extreme cases if a guest program is handling untrusted input then the guest program may deviate from its intended execution, for example calling an imported host function with different arguments than intended. This still does not impact embedders, however, because there is no form of privilege escalation with the guest.

At this time it's expected that this codegen pattern doesn't show up in the wild that often. LLVM-generated modules, for example, do not appear to conventionally or idiomatically generate code which would hit this bug. It is possible, however, to still write code which triggers this, so it's recommended for embedders to analyze existing modules to see if any are affected.

Patches

This codegen bug has been fixed in Wasmtime 6.0.1, 5.0.1, and 4.0.1. Users are recommended to upgrade to these updated versions.

Workarounds

If upgrading is not an option for you at this time, you can avoid this miscompilation by disabling the Wasm simd proposal

rust config.wasmsimd(false);

Additionally the bug is only present on x8664 hosts. Other platforms such as AArch64 and s390x are not affected.

References

The WebAssembly simd proposal Mailing list announcement GitHub advisory Commit to fix this issue on Wasmtime's main branch

For more information

If you have any questions or comments about this advisory:

Reach out to us on the Bytecode Alliance Zulip chat Open an issue in the bytecodealliance/wasmtime repository

Impact

There was a bug in Wasmtime's code generator, Cranelift, for AArch64 targets where constant divisors could result in incorrect division results at runtime. The translation rules for constants did not take into account whether sign- or zero-extension should happen, which resulted in an incorrect value being placed into a register when a division was encountered. For example, a constant 32-bit unsigned divisor of 0xfffffffe would be incorrectly sign-extended to 64-bits to 0xfffffffffffffffe. Any kind of division of operands smaller than 64 bits is implemented with a 64-bit division instruction which would then result in an incorrect result because the divisor was larger than expected.

The impact of this bug is that programs executing within the WebAssembly sandbox would not behave according to the WebAssembly specification. This means that it is hypothetically possible for execution within the sandbox to go awry and WebAssembly programs could produce unexpected results. This should not impact hosts executing WebAssembly, but does affect the correctness of guest programs.

This bug was found with differential fuzzing of Wasmtime against other engines on the AArch64 platform. Fuzzing on AArch64 is not regularly performed at this time and the Wasmtime team is investigating how best to continuously fuzz AArch64 in the same manner as x8664.

Patches

This bug has been patched and users should upgrade to Wasmtime version 0.38.2.

Workarounds

If upgrading is not an option at this time, direct users of Cranelift that control the exact Cranelift instructions being compiled can avoid the vulnerability by explicitly extending constant divisors to 64 bits using either the sextend.i64 or the uextend.i64 operation.

Note, though, that this issue only affects the AArch64 targets. Other platforms are not affected.

For more information

If you have any questions or comments about this advisory:

Reach out to us on the Bytecode Alliance Zulip chat Open an issue in the bytecodealliance/wasmtime repository

There is a bug in Wasmtime's code generator, Cranelift, where functions using reference types may be incorrectly missing metadata required for runtime garbage collection (GC). This means that if a GC happens at runtime then the collector will mistakenly think some Wasm stack frames do not have live references to garbage collected values and therefore reclaim and deallocate them. The function can then subsequently continue to use the values, leading later to use-after-free bugs. This bug was introduced in Cranelift's migration to the regalloc2 register allocator in the Wasmtime 0.37.0 release on 2022-05-20. This bug has been patched and users should upgrade to Wasmtime version 0.38.2.

Mitigations for this issue can be achieved by doing one of:

Disabling the reference types proposal by passing false to wasmtime::Config::wasmreferencetypes. Downgrading to Wasmtime 0.36.0 or prior.

Impact

Wasmtime's implementation of the SIMD proposal for WebAssembly on x8664 contained two distinct bugs in the instruction lowerings implemented in Cranelift. The aarch64 implementation of the simd proposal is not affected. The bugs were presented in the i8x16.swizzle and select WebAssembly instructions. The select instruction is only affected when the inputs are of v128 type. The correspondingly affected Cranelift instructions were swizzle and select.

The swizzle instruction lowering in Cranelift erroneously overwrote the mask input register which could corrupt a constant value, for example. This means that future uses of the same constant may see a different value than the constant itself.

The select instruction lowering in Cranelift wasn't correctly implemented for vector types that are 128-bits wide. When the condition was 0 the wrong instruction was used to move the correct input to the output of the instruction meaning that only the low 32 bits were moved and the upper 96 bits of the result were left as whatever the register previously contained (instead of the input being moved from). The select instruction worked correctly if the condition was nonzero, however.

This bug in Wasmtime's implementation of these instructions on x8664 represents an incorrect implementation of the specified semantics of these instructions according to the WebAssembly specification. The impact of this is benign for hosts running WebAssembly but represents possible vulnerabilities within the execution of a guest program. For example a WebAssembly program could take unintended branches or materialize incorrect values internally which runs the risk of exposing the program itself to other related vulnerabilities which can occur from miscompilations.

Patches

We have released Wasmtime 0.38.1 and cranelift-codegen (and other associated cranelift crates) 0.85.1 which contain the corrected implementations of these two instructions in Cranelift.

Workarounds

If upgrading is not an option for you at this time, you can avoid the vulnerability by disabling the Wasm simd proposal

rust config.wasmsimd(false);

Additionally the bug is only present on x8664 hosts. Other aarch64 hosts are not affected. Note that s390x hosts don't yet implement the simd proposal and are not affected.

References

The WebAssembly simd proposal Original test case showing the erroneous behavior Fix for the swizzle instruction Fix for the select instruction

For more information

If you have any questions or comments about this advisory:

Reach out to us on the Bytecode Alliance Zulip chat Open an issue in the bytecodealliance/wasmtime repository

Cranelift is an open-source code generator maintained by Bytecode Alliance. It translates a target-independent intermediate representation into executable machine code. There is a bug in 0.73 of the Cranelift x64 backend that can create a scenario that could result in a potential sandbox escape in a Wasm program. This bug was introduced in the new backend on 2020-09-08 and first included in a release on 2020-09-30, but the new backend was not the default prior to 0.73. The recently-released version 0.73 with default settings, and prior versions with an explicit build flag to select the new backend, are vulnerable. The bug in question performs a sign-extend instead of a zero-extend on a value loaded from the stack, under a specific set of circumstances. If those circumstances occur, the bug could allow access to memory addresses upto 2GiB before the start of the Wasm program heap. If the heap bound is larger than 2GiB, then it would be possible to read memory from a computable range dependent on the size of the heaps bound. The impact of this bug is highly dependent on heap implementation, specifically: if the heap has bounds checks, and does not rely exclusively on guard pages, and the heap bound is 2GiB or smaller then this bug cannot be used to reach memory from another Wasm program heap. The impact of the vulnerability is mitigated if there is no memory mapped in the range accessible using this bug, for example, if there is a 2 GiB guard region before the Wasm program heap. The bug in question performs a sign-extend instead of a zero-extend on a value loaded from the stack, when the register allocator reloads a spilled integer value narrower than 64 bits. This interacts poorly with another optimization: the instruction selector elides a 32-to-64-bit zero-extend operator when we know that an instruction producing a 32-bit value actually zeros the upper 32 bits of its destination register. Hence, we rely on these zeroed bits, but the type of the value is still i32, and the spill/reload reconstitutes those bits as the sign extension of the i32’s MSB. The issue would thus occur when: An i32 value in a Wasm program is greater than or equal to 0x80000000; The value is spilled and reloaded by the register allocator due to high register pressure in the program between the value’s definition and its use; The value is produced by an instruction that we know to be “special” in that it zeroes the upper 32 bits of its destination: add, sub, mul, and, or; The value is then zero-extended to 64 bits in the Wasm program; The resulting 64-bit value is used. Under these circumstances there is a potential sandbox escape when the i32 value is a pointer. The usual code emitted for heap accesses zero-extends the Wasm heap address, adds it to a 64-bit heap base, and accesses the resulting address. If the zero-extend becomes a sign-extend, the program could reach backward and access memory up to 2GiB before the start of its heap. In addition to assessing the nature of the code generation bug in Cranelift, we have also determined that under specific circumstances, both Lucet and Wasmtime using this version of Cranelift may be exploitable. See referenced GitHub Advisory for more details.