Bug 2006110 (CVE-2021-39218) - CVE-2021-39218 wasmtime: Memory unsoundness vulnerability
Summary: CVE-2021-39218 wasmtime: Memory unsoundness vulnerability
Keywords:
Status: CLOSED UPSTREAM
Alias: CVE-2021-39218
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2006111 2006112 2006113
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-09-20 21:18 UTC by Pedro Sampaio
Modified: 2021-09-21 00:21 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-09-21 00:21:16 UTC


Attachments (Terms of Use)

Description Pedro Sampaio 2021-09-20 21:18:52 UTC
Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.26.0 and before version 0.30.0 is affected by a memory unsoundness vulnerability. There was an invalid free and out-of-bounds read and write bug when running Wasm that uses `externref`s in Wasmtime. To trigger this bug, Wasmtime needs to be running Wasm that uses `externref`s, the host creates non-null `externrefs`, Wasmtime performs a garbage collection (GC), and there has to be a Wasm frame on the stack that is at a GC safepoint where there are no live references at this safepoint, and there is a safepoint with live references earlier in this frame's function. Under this scenario, Wasmtime would incorrectly use the GC stack map for the safepoint from earlier in the function instead of the empty safepoint. This would result in Wasmtime treating arbitrary stack slots as `externref`s that needed to be rooted for GC. At the *next* GC, it would be determined that nothing was referencing these bogus `externref`s (because nothing could ever reference them, because they are not really `externref`s) and then Wasmtime would deallocate them and run `<ExternRef as Drop>::drop` on them. This results in a free of memory that is not necessarily on the heap (and shouldn't be freed at this moment even if it was), as well as potential out-of-bounds reads and writes. Even though support for `externref`s (via the reference types proposal) is enabled by default, unless you are creating non-null `externref`s in your host code or explicitly triggering GCs, you cannot be affected by this bug. We have reason to believe that the effective impact of this bug is relatively small because usage of `externref` is currently quite rare. This bug has been patched and users should upgrade to Wasmtime version 0.30.0. If you cannot upgrade Wasmtime at this time, you can avoid this bug by disabling the reference types proposal by passing `false` to `wasmtime::Config::wasm_reference_types`.

https://crates.io/crates/wasmtime
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4873-36h9-wv49
https://github.com/bytecodealliance/wasmtime/commit/398a73f0dd862dbe703212ebae8e34036a18c11c

Comment 1 Pedro Sampaio 2021-09-20 21:19:17 UTC
Created rust-wasmtime-cache tracking bugs for this issue:

Affects: fedora-34 [bug 2006111]


Created rust-wasmtime-environ tracking bugs for this issue:

Affects: fedora-34 [bug 2006113]


Created rust-wasmtime-fiber tracking bugs for this issue:

Affects: fedora-34 [bug 2006112]

Comment 2 Product Security DevOps Team 2021-09-21 00:21:16 UTC
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.


Note You need to log in before you can comment on or make changes to this bug.