VDB
Sign up
MEDIUM6.5

GHSA-jxhv-7h78-9775

Wasmtime: Panic when transcoding misaligned utf-16 strings

Details

### Impact

Wasmtime's implementation of transcoding strings into the Component Model's `utf16` or `latin1+utf16` encodings improperly verified the alignment of reallocated strings. This meant that unaligned pointers could be passed to the host for transcoding which would trigger a host panic. This panic is possible to trigger from malicious guests which transfer very specific strings across components with specific addresses.

Host panics are considered a DoS vector in Wasmtime as the panic conditions are controlled by the guest in this situation.

### Patches

Wasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime.

### Workarounds

There is no workaround for this bug. Hosts are recommended to updated to a patched version of Wasmtime.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/wasmtime
Introduced in: 0Fixed in: 24.0.7

Upgrade wasmtime to 24.0.7 or newer (ecosystem crates.io).

crates.io/wasmtime
Introduced in: 25.0.0Fixed in: 36.0.7

Upgrade wasmtime to 36.0.7 or newer (ecosystem crates.io).

crates.io/wasmtime
Introduced in: 37.0.0Fixed in: 42.0.2

Upgrade wasmtime to 42.0.2 or newer (ecosystem crates.io).

crates.io/wasmtime
Introduced in: 43.0.0Fixed in: 43.0.1

Upgrade wasmtime to 43.0.1 or newer (ecosystem crates.io).

References