Heap-use-after-free vulnerability in wasmtime
Summary
OSV-2022-597: Heap-use-after-free in .tmpgt0oOx. Affects wasmtime versions >= 08a60a0f082a68149218f4c82da04b39fac59611. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
wasmtime is an open-source runtime for WebAssembly, developed by the Bytecode Alliance. It allows executing WebAssembly modules outside of the web browser, enabling high-performance and secure execution of code. The runtime provides a set of APIs and tools for interacting with WebAssembly modules. However, a heap-use-after-free vulnerability has been discovered in the .tmpgt0oOx component of wasmtime.
Vulnerability Detail
The heap-use-after-free vulnerability in .tmpgt0oOx can lead to a crash due to a read of 8 bytes from a freed heap memory region. This vulnerability has been reported by OSS-Fuzz and can be triggered by calling the wasmtime_setjmp function. An attacker could potentially exploit this vulnerability to execute arbitrary code or cause a denial-of-service condition. The vulnerability has been assigned a severity rating of HIGH.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
At the moment, there is no known workaround for this vulnerability. It is advised to apply the official fix as soon as it becomes available.
Conclusion
In conclusion, a heap-use-after-free vulnerability has been discovered in the .tmpgt0oOx component of wasmtime. This vulnerability can potentially be exploited by attackers to execute arbitrary code or cause a denial-of-service condition. Users are advised to update to a patched version of wasmtime as soon as it becomes available. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for wasmtime →
FAQ
wasmtime is an open-source runtime for WebAssembly, allowing the execution of WebAssembly modules outside of the web browser.
A heap-use-after-free vulnerability occurs when a program attempts to access memory that has already been freed. This can lead to crashes, arbitrary code execution, or other security issues.
An attacker could exploit this vulnerability by triggering the heap-use-after-free condition, potentially leading to the execution of arbitrary code or causing a denial-of-service condition.
This vulnerability has been assigned a severity rating of HIGH.
Currently, there is no known workaround for this vulnerability. It is recommended to apply the official fix once it becomes available.
References
Related vulnerabilities
Recent vulnerabilities recorded for wasmtime.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
