wabt vulnerabilities

wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations, primarily on 32-bit platforms (a "table flip" attack). It does not check the return value of calloc() in wasm_rt_allocate_funcref_table(); when the funcref table allocation fails, table->data remains NULL while table->size keeps the guest-declared element count, enabling arbitrary read/write of host memory and arbitrary code execution. Exploitation requires the allocation to fail, e.g., under an address-space limit, on 32-bit hosts, or under memory pressure.

An out-of-bounds read vulnerability was found in WebAssembly wabt up to 1.0.39, in the function wabt::Decompiler::VarName of the file /src/repro/wabt/bin/wasm-decompile. Local access is required for the attack.

A vulnerability in WebAssembly wabt up to 1.0.39 affects the function wabt::AST::InsertNode in the file /src/repro/wabt/bin/wasm-decompile of the wasm-decompile component. The manipulation causes memory corruption. The attack can be launched on the local host, and the exploit has been made publicly available.