Free of Memory not on the Heap in Wasmtime - CVE-2021-39218

Vulnerability identifier: #VU127031

CSH Severity: Medium

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-39218

CWE-ID: CWE-590

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to incorrect GC stack map handling in Wasmtime externref and GC safepoint handling when running Wasm that uses externrefs during garbage collection. A remote attacker can execute crafted Wasm that uses externrefs to cause memory corruption.

Exploitation requires the host to create non-null externrefs and a garbage collection to occur while a Wasm frame is at a GC safepoint with no live references after an earlier safepoint in the same function had live references.

Wasmtime
Fedora
rust-backtrace
rust-addr2line
rust-gimli
rust-object
rust-wasmtime-fiber
rust-wasmtime-environ
rust-wasmtime-cache
rust-wasmtime-types
rust-cranelift-wasm
rust-cranelift-native
rust-cranelift-frontend
rust-cranelift-entity
rust-cranelift-codegen-shared
rust-cranelift-codegen-meta
rust-cranelift-codegen
rust-cranelift-bforest
rust-wasmparser
rust-wat
rust-wast

Install security update from vendor's website.

Wasmtime - update to 0.30.0
rust-backtrace - addressed in versions 0.3.61-1.fc34, 0.3.61-1.fc35, 0.3.61-1.fc36
rust-addr2line - addressed in versions 0.16.0-1.fc34, 0.16.0-1.fc35, 0.16.0-1.fc36
rust-gimli - addressed in versions 0.25.0-1.fc34, 0.25.0-1.fc35, 0.25.0-1.fc36
rust-object - addressed in versions 0.26.2-1.fc34, 0.26.2-1.fc35, 0.26.2-1.fc36
rust-wasmtime-fiber - addressed in versions 0.30.0-1.fc34, 0.30.0-1.fc35, 0.30.0-1.fc36
rust-wasmtime-environ - addressed in versions 0.30.0-1.fc34, 0.30.0-1.fc35
rust-wasmtime-cache - addressed in versions 0.30.0-1.fc34, 0.30.0-1.fc35, 0.30.0-1.fc36
rust-wasmtime-types - addressed in versions 0.30.0-2.fc34, 0.30.0-2.fc35
rust-cranelift-wasm - addressed in versions 0.77.0-1.fc34, 0.77.0-1.fc35
rust-cranelift-native - addressed in versions 0.77.0-1.fc34, 0.77.0-1.fc35, 0.77.0-1.fc36
rust-cranelift-frontend - addressed in versions 0.77.0-1.fc34, 0.77.0-1.fc35, 0.77.0-1.fc36
rust-cranelift-entity - addressed in versions 0.77.0-1.fc34, 0.77.0-1.fc35, 0.77.0-1.fc36
rust-cranelift-codegen-shared - addressed in versions 0.77.0-1.fc34, 0.77.0-1.fc35, 0.77.0-1.fc36
rust-cranelift-codegen-meta - addressed in versions 0.77.0-1.fc34, 0.77.0-1.fc35, 0.77.0-1.fc36
rust-cranelift-codegen - addressed in versions 0.77.0-1.fc34, 0.77.0-1.fc35, 0.77.0-1.fc36
rust-cranelift-bforest - addressed in versions 0.77.0-1.fc34, 0.77.0-1.fc35, 0.77.0-1.fc36
rust-wasmparser - addressed in versions 0.80.1-1.fc34, 0.80.1-1.fc35, 0.80.1-1.fc36
rust-wat - addressed in versions 1.0.40-1.fc34, 1.0.40-1.fc35, 1.0.40-1.fc36
rust-wast - addressed in versions 38.0.0-2.fc34, 38.0.0-2.fc35, 38.0.0-2.fc36

• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4873-36h9-wv49
• https://github.com/advisories/GHSA-4873-36h9-wv49

• Multiple vulnerabilities in Wasmtime
• Fedora 36 update for rust-addr2line, rust-backtrace, rust-cranelift-bforest, rust-cranelift-codegen, rust-cranelift-codegen-meta, rust-cranelift-codegen-shared, rust-cranelift-entity, rust-cranelift-frontend, rust-cranelift-native, rust-gimli, rust-object
• Fedora 35 update for rust-addr2line, rust-backtrace, rust-cranelift-bforest, rust-cranelift-codegen, rust-cranelift-codegen-meta, rust-cranelift-codegen-shared, rust-cranelift-entity, rust-cranelift-frontend, rust-cranelift-native, rust-cranelift-wasm, ru
• Fedora 34 update for rust-addr2line, rust-backtrace, rust-cranelift-bforest, rust-cranelift-codegen, rust-cranelift-codegen-meta, rust-cranelift-codegen-shared, rust-cranelift-entity, rust-cranelift-frontend, rust-cranelift-native, rust-cranelift-wasm, ru