Vulnerability in Bytecodealliance Wasmtime
CVE-2022-39393
Wasmtime is a standalone runtime for WebAssembly. Prior to versions 2.0.2 and 1.0.2, there is a bug in Wasmtime's implementation of its pooling instance allocator where when a linear memory is reused for another instance the initial heap snapshot of the prior instance can be visible, erroneously to the next instance. This bug has been patched and users should upgrade to Wasmtime 2.0.2 and 1.0.2. Other mitigations include disabling the pooling allocator and disabling the `memory-init-cow`.
EPSS: 0.007 (50.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N.
Affected products
- Bytecodealliance Wasmtime — versions >= 2.0.0, < 2.0.2, < 1.0.2
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2022-39393?
- CVE-2022-39393 is a high-severity vulnerability in Bytecodealliance Wasmtime, classified under Sensitive Information in Resource Not Removed Before Reuse. CVSS score: 8.6/10. Published 2022-11-10.
- How severe is CVE-2022-39393?
- High severity. CVSS v3 base score is 8.6 out of 10.