Wasmtime vulnerabilities

Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.11, 36.0.12, 45.0.3, and 46.0.1, the wasmtime-wasi component checked directory permissions but not matching FilePerms on source and destination preopens during hard-link creation and renaming. This allowed a WASI guest with read-only source file capability to overwrite host files exposed as FilePerms::READ through wasip1, wasip2, or wasip3 filesystem interfaces.

Wasmtime prior to versions 24.0.10, 36.0.11, 44.0.3, and 45.0.2 contains a vulnerability in the native WASIp1 implementation where the fd_renumber function fails to properly close the target file descriptor. This causes resource leaks in the host system, potentially leading to exhaustion of file descriptors and resources.

Wasmtime, a runtime for WebAssembly, has a vulnerability in versions prior to 24.0.9, 36.0.10, and 44.0.2 that allows bypassing the access control mechanism using the wasip2 descriptor.open-at or wasip1 path_open interfaces. The issue arises from a missing assignment in the open mode handling, allowing files to be opened with the OpenFlags::TRUNCATE flag without the necessary write permissions.

Wasmtime versions 30.0.0 through 36.0.8, 43.0.2, and 44.0.1 contain a vulnerability where allocation logic for WebAssembly tables panics on overflow. This panic can be triggered when allocating extremely large tables (64-bit range via memory64 proposal). An attacker can cause a denial of service by providing a WebAssembly module or component that requests such a large table.

Wasmtime versions 32.0.0 through 36.0.7, 42.0.2, and 43.0.1 have a bug in the Cranelift compiler on aarch64 that miscalculates memory addresses during heap access. This allows WebAssembly modules to bypass bounds checks and access arbitrary host memory, resulting in a sandbox escape.