Critical Vulnerability in rust-wasmtime: Bypass of Filesystem Sandbox on Windows
Summary
DEBIAN-CVE-2024-51745: Wasmtime is a fast and secure runtime for WebAssembly. Affects rust-wasmtime versions < 26.0.1+dfsg-1. Fixed in 26.0.1+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rust-wasmtime is a high-performance runtime for WebAssembly, designed to execute WebAssembly modules securely and efficiently. It provides a sandboxed environment for running untrusted code, ensuring that such code cannot access the underlying system resources directly. However, a recent vulnerability has exposed a flaw in its filesystem sandbox implementation on Windows, allowing potential unauthorized access to special device filenames.
Vulnerability Detail
The vulnerability arises from the failure of Wasmtime's filesystem sandbox on Windows to block access to special device filenames that use superscript digits, such as 'COM¹', 'COM²', 'LPT⁰', and 'LPT¹'. This oversight allows untrusted WebAssembly programs to bypass the sandbox restrictions and access peripheral devices connected to the computer, including modems, printers, and network resources. The issue affects users of Wasmtime versions 23.0.x and earlier, posing significant security risks as it could lead to unauthorized access to sensitive hardware and data.
How To Fix
Minimum fixed version
26.0.1+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade rust-wasmtimeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are currently no known workarounds for this issue. The recommended action is to upgrade to the patched versions of rust-wasmtime.
Conclusion
The rust-wasmtime package has a critical vulnerability that allows untrusted WebAssembly programs to bypass filesystem sandbox restrictions on Windows. Users are strongly advised to upgrade to the patched versions to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for rust-wasmtime →
FAQ
rust-wasmtime is a runtime for executing WebAssembly modules, providing a secure and efficient environment for running untrusted code.
The vulnerability allows untrusted WebAssembly programs to access special device filenames, potentially leading to unauthorized access to peripheral devices and sensitive data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Versions 23.0.x and earlier of rust-wasmtime are affected by this vulnerability.
Currently, there are no workarounds available. The only solution is to upgrade to a patched version of rust-wasmtime.
References
Related vulnerabilities
Recent vulnerabilities recorded for rust-wasmtime.
