Vulnerability in Bytecodealliance Wasmtime
CVE-2022-39393
Wasmtime is a standalone runtime for WebAssembly. Prior to versions 2.0.2 and 1.0.2, there is a bug in Wasmtime's implementation of its pooling instance allocator where when a linear memory is reused for another instance the initial heap snapshot of the prior instance can be visible, erroneously to the next instance. This bug has been patched and users should upgrade to Wasmtime 2.0.2 and 1.0.2. Other mitigations include disabling the pooling allocator and disabling the `memory-init-cow`.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.008 (54.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 54th percentile — 54.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.007 · newest: 0.008 · change: +0.000
Affected products
- Bytecodealliance Wasmtime — versions >= 2.0.0, < 2.0.2, < 1.0.2
Weakness classification (CWE)
References
- github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wh6w-3828-g9qf (Third Party Advisory)
- github.com/bytecodealliance/wasmtime/commit/2614f2e9d2d36805ead8a8da0fa0c6e0d9e… (Patch, Third Party Advisory)
Frequently asked questions
- What is CVE-2022-39393?
- CVE-2022-39393 is a high-severity vulnerability in Bytecodealliance Wasmtime, classified under Sensitive Information in Resource Not Removed Before Reuse. CVSS score: 8.6/10. Published 2022-11-10.
- How severe is CVE-2022-39393?
- High severity. CVSS v3 base score is 8.6 out of 10.