Critical Panic Vulnerability in rust-wasmtime Package
Summary
DEBIAN-CVE-2024-30266: wasmtime is a runtime for WebAssembly. Affects rust-wasmtime versions < 21.0.2+dfsg-1. Fixed in 21.0.2+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rust-wasmtime is a runtime for executing WebAssembly modules, designed to provide a safe and efficient environment for running WebAssembly code. It allows developers to integrate WebAssembly into their applications, enabling high-performance execution of code written in various languages. However, the package has recently been identified with a vulnerability that can lead to runtime panics, impacting the stability of applications using this runtime.
Vulnerability Detail
The vulnerability arises from a regression introduced in the 19.0.0 release of Wasmtime, which can cause a valid WebAssembly module to trigger a panic in the host runtime. This issue can lead to unexpected crashes and instability in applications that rely on the rust-wasmtime package, potentially affecting user experience and application reliability. The vulnerability has been addressed in version 19.0.1, making it critical for users to update their installations to avoid these issues.
How To Fix
Minimum fixed version
21.0.2+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade rust-wasmtimeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid executing potentially untrusted WebAssembly modules until they have updated to the patched version. This can help mitigate the risk of encountering the panic issue while a proper fix is being implemented.
Conclusion
The rust-wasmtime package has a critical vulnerability that can lead to runtime panics when executing WebAssembly modules. Users are strongly advised to update to the patched version to ensure application stability and security. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for rust-wasmtime →
FAQ
The vulnerability is a regression that can cause a panic in the host runtime when executing valid WebAssembly modules.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
The vulnerability can lead to application crashes and instability, affecting user experience and reliability.
Yes, the vulnerability has been patched in version 21.0.2+dfsg-1 of the rust-wasmtime package.
As a workaround, avoid executing untrusted WebAssembly modules until you can update to the patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for rust-wasmtime.
