SB2021052128 - Access of Memory Location After End of Buffer in cranelift-codegen

Description

This security bulletin contains information about 1 vulnerability.

1) Access of Memory Location After End of Buffer (CVE-ID: CVE-2021-32629)

The vulnerability allows a remote attacker to access memory outside the intended WebAssembly sandbox.

The vulnerability exists due to improper code generation in the Cranelift x64 backend when reloading spilled integer values narrower than 64 bits during WebAssembly heap address computation. A remote attacker can execute a specially crafted WebAssembly module to access memory outside the intended WebAssembly sandbox.

The issue occurs when a spilled i32 value is sign-extended instead of zero-extended under specific register-allocation and instruction-selection conditions, and can allow access to memory up to 2 GiB before the start of the module heap.

Remediation

Install update from vendor's website.

References

• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hpqh-2wqx-7qp5
• https://github.com/advisories/GHSA-hpqh-2wqx-7qp5