SB2023091467 - Off-by-one in Wasmtime

Description

This security bulletin contains information about 1 vulnerability.

1) Off-by-one (CVE-ID: CVE-2023-41880)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to cause incorrect computation results.

The vulnerability exists due to an off-by-one error in the Cranelift code generator for the WebAssembly i64x2.shr_s instruction when compiling WebAssembly on x86_64 with a constant shift amount larger than 32. A remote privileged user can execute a specially crafted WebAssembly program to cause incorrect computation results.

This issue is not an escape from the WebAssembly sandbox and affects only x86_64 hosts.

Remediation

Install update from vendor's website.

References

• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gw5p-q8mj-p7gh
• https://github.com/advisories/GHSA-gw5p-q8mj-p7gh