Segv on unknown address in wasmtime_runtime::traphandlers::catch_traps::call_closure::hec711b3339636b04
Summary
OSV-2022-781: Segv on unknown address in wasmtime_runtime::traphandlers::catch_traps::call_closure::hec711b3339636b04. Affects wasmtime versions >= cee4b209f346ea279490268fe434dc52d0e0680c, < dde2c5a3b6ee6caa1d597da0885613d2ce6a406a. Fixed in dde2c5a3b6ee6caa1d597da0885613d2ce6a406a. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The package under scrutiny is wasmtime, which is part of the OSS-Fuzz ecosystem. Wasmtime is a runtime for WebAssembly that allows running WebAssembly modules in various contexts. It provides a set of APIs and tools for executing and interacting with WebAssembly code. The vulnerability affects the package and can lead to a segmentation fault (Segv) on an unknown address.
Vulnerability Detail
The vulnerability occurs in the wasmtime_runtime::traphandlers::catch_traps::call_closure::hec711b3339636b04 function. It has been reported through an OSS-Fuzz report, which provides additional details. The crash type is a Segv on an unknown address. The vulnerable state involves the wasmtime_setjmp and wasmtime::linker::Linker::instantiate functions. The exact cause and impact of the vulnerability are not specified in the provided information.
How To Fix
Minimum fixed version
dde2c5a3b6ee6caa1d597da0885613d2ce6a406a
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround is mentioned in the provided information. It is advisable to follow the recommended fix and update the package to a fixed version.
Conclusion
In conclusion, the wasmtime package is vulnerable to a Segv on an unknown address. To fix this vulnerability, it is recommended to update the package to a version that includes the fix. No specific workaround is mentioned. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for wasmtime →
FAQ
Wasmtime is a runtime for WebAssembly that allows running WebAssembly modules in various contexts. It provides a set of APIs and tools for executing and interacting with WebAssembly code.
The impact of this vulnerability is not specified in the provided information. However, it can lead to a segmentation fault (Segv) on an unknown address.
To fix this vulnerability, it is recommended to update the wasmtime package to a version that includes the fix. The fix can be found in commit dde2c5a3b6ee6caa1d597da0885613d2ce6a406a of the wasmtime repository.
No specific workaround is mentioned in the provided information. It is advisable to follow the recommended fix and update the package to a fixed version.
More information about this vulnerability can be found in the OSS-Fuzz report linked in the provided information.
References
Related vulnerabilities
Recent vulnerabilities recorded for wasmtime.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
