Type Confusion in Wasmtime - CVE-2021-39219

Vulnerability identifier: #VU127032

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-39219

CWE-ID: CWE-843

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to cause memory unsafety.

The vulnerability exists due to type confusion in Linker::func_* APIs when using a Linker created with one Engine to instantiate a module into a Store created with a different Engine. A local user can use mismatched Engine values across Linker and Store operations to cause memory unsafety.

Exploitation requires an embedding that uses at least two Engine instances and reuses a Linker across them.

Wasmtime
Fedora
rust-backtrace
rust-addr2line
rust-gimli
rust-object
rust-wasmtime-fiber
rust-wasmtime-environ
rust-wasmtime-cache
rust-wasmtime-types
rust-cranelift-wasm
rust-cranelift-native
rust-cranelift-frontend
rust-cranelift-entity
rust-cranelift-codegen-shared
rust-cranelift-codegen-meta
rust-cranelift-codegen
rust-cranelift-bforest
rust-wasmparser
rust-wat
rust-wast

Install security update from vendor's website.

Wasmtime - update to 0.30.0
rust-backtrace - addressed in versions 0.3.61-1.fc34, 0.3.61-1.fc35, 0.3.61-1.fc36
rust-addr2line - addressed in versions 0.16.0-1.fc34, 0.16.0-1.fc35, 0.16.0-1.fc36
rust-gimli - addressed in versions 0.25.0-1.fc34, 0.25.0-1.fc35, 0.25.0-1.fc36
rust-object - addressed in versions 0.26.2-1.fc34, 0.26.2-1.fc35, 0.26.2-1.fc36
rust-wasmtime-fiber - addressed in versions 0.30.0-1.fc34, 0.30.0-1.fc35, 0.30.0-1.fc36
rust-wasmtime-environ - addressed in versions 0.30.0-1.fc34, 0.30.0-1.fc35
rust-wasmtime-cache - addressed in versions 0.30.0-1.fc34, 0.30.0-1.fc35, 0.30.0-1.fc36
rust-wasmtime-types - addressed in versions 0.30.0-2.fc34, 0.30.0-2.fc35
rust-cranelift-wasm - addressed in versions 0.77.0-1.fc34, 0.77.0-1.fc35
rust-cranelift-native - addressed in versions 0.77.0-1.fc34, 0.77.0-1.fc35, 0.77.0-1.fc36
rust-cranelift-frontend - addressed in versions 0.77.0-1.fc34, 0.77.0-1.fc35, 0.77.0-1.fc36
rust-cranelift-entity - addressed in versions 0.77.0-1.fc34, 0.77.0-1.fc35, 0.77.0-1.fc36
rust-cranelift-codegen-shared - addressed in versions 0.77.0-1.fc34, 0.77.0-1.fc35, 0.77.0-1.fc36
rust-cranelift-codegen-meta - addressed in versions 0.77.0-1.fc34, 0.77.0-1.fc35, 0.77.0-1.fc36
rust-cranelift-codegen - addressed in versions 0.77.0-1.fc34, 0.77.0-1.fc35, 0.77.0-1.fc36
rust-cranelift-bforest - addressed in versions 0.77.0-1.fc34, 0.77.0-1.fc35, 0.77.0-1.fc36
rust-wasmparser - addressed in versions 0.80.1-1.fc34, 0.80.1-1.fc35, 0.80.1-1.fc36
rust-wat - addressed in versions 1.0.40-1.fc34, 1.0.40-1.fc35, 1.0.40-1.fc36
rust-wast - addressed in versions 38.0.0-2.fc34, 38.0.0-2.fc35, 38.0.0-2.fc36

• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q879-9g95-56mx

• Multiple vulnerabilities in Wasmtime
• Fedora 36 update for rust-addr2line, rust-backtrace, rust-cranelift-bforest, rust-cranelift-codegen, rust-cranelift-codegen-meta, rust-cranelift-codegen-shared, rust-cranelift-entity, rust-cranelift-frontend, rust-cranelift-native, rust-gimli, rust-object
• Fedora 35 update for rust-addr2line, rust-backtrace, rust-cranelift-bforest, rust-cranelift-codegen, rust-cranelift-codegen-meta, rust-cranelift-codegen-shared, rust-cranelift-entity, rust-cranelift-frontend, rust-cranelift-native, rust-cranelift-wasm, ru
• Fedora 34 update for rust-addr2line, rust-backtrace, rust-cranelift-bforest, rust-cranelift-codegen, rust-cranelift-codegen-meta, rust-cranelift-codegen-shared, rust-cranelift-entity, rust-cranelift-frontend, rust-cranelift-native, rust-cranelift-wasm, ru