Vulnerability · Published Nov 10, 2022 · Assigned by GitHub_M
CVE-2022-39393Wasmtime vulnerable to data leakage between instances in the pooling allocator
High 8.6
In plain English
A high-severity security flaw in wasmtime from bytecodealliance. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities).
Official description
Wasmtime is a standalone runtime for WebAssembly. Prior to versions 2.0.2 and 1.0.2, there is a bug in Wasmtime's implementation of its pooling instance allocator where when a linear memory is reused for another instance the initial heap snapshot of the prior instance can be visible, erroneously to the next instance. This bug has been patched and users should upgrade to Wasmtime 2.0.2 and 1.0.2. Other mitigations include disabling the pooling allocator and disabling the `memory-init-cow`.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | mozjs78 | no fix listed | UBUNTU-CVE-2022-39393 |
| Ubuntu:22.04:LTS | mozjs91 | no fix listed | UBUNTU-CVE-2022-39393 |
| Ubuntu:22.04:LTS | thunderbird | no fix listed | UBUNTU-CVE-2022-39393 |
| Ubuntu:24.04:LTS | thunderbird | no fix listed | UBUNTU-CVE-2022-39393 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| bytecodealliance | wasmtime | >= 2.0.0, < 2.0.2< 1.0.2 |
Weakness: CWE-226 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N