Use-after-free in Wasmtime - CVE-2021-39216

Vulnerability identifier: #VU127033

CSH Severity: Low

CVSS v4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-39216

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to cause a denial of service or potentially execute arbitrary code.

The vulnerability exists due to use-after-free in externref handling when passing multiple externrefs from host code to guest Wasm content at the same time. A remote user can pass multiple externrefs as arguments or return multiple externrefs from a host-defined multi-value function to cause a denial of service or potentially execute arbitrary code.

The issue can be triggered if the VMExternRefActivationsTable becomes full after the first externref is passed, causing garbage collection before control is transferred to Wasm.

Wasmtime
Fedora
rust-backtrace
rust-addr2line
rust-gimli
rust-object
rust-wasmtime-fiber
rust-wasmtime-environ
rust-wasmtime-cache
rust-wasmtime-types
rust-cranelift-wasm
rust-cranelift-native
rust-cranelift-frontend
rust-cranelift-entity
rust-cranelift-codegen-shared
rust-cranelift-codegen-meta
rust-cranelift-codegen
rust-cranelift-bforest
rust-wasmparser
rust-wat
rust-wast

Install security update from vendor's website.

Wasmtime - update to 0.30.0
rust-backtrace - addressed in versions 0.3.61-1.fc34, 0.3.61-1.fc35, 0.3.61-1.fc36
rust-addr2line - addressed in versions 0.16.0-1.fc34, 0.16.0-1.fc35, 0.16.0-1.fc36
rust-gimli - addressed in versions 0.25.0-1.fc34, 0.25.0-1.fc35, 0.25.0-1.fc36
rust-object - addressed in versions 0.26.2-1.fc34, 0.26.2-1.fc35, 0.26.2-1.fc36
rust-wasmtime-fiber - addressed in versions 0.30.0-1.fc34, 0.30.0-1.fc35, 0.30.0-1.fc36
rust-wasmtime-environ - addressed in versions 0.30.0-1.fc34, 0.30.0-1.fc35
rust-wasmtime-cache - addressed in versions 0.30.0-1.fc34, 0.30.0-1.fc35, 0.30.0-1.fc36
rust-wasmtime-types - addressed in versions 0.30.0-2.fc34, 0.30.0-2.fc35
rust-cranelift-wasm - addressed in versions 0.77.0-1.fc34, 0.77.0-1.fc35
rust-cranelift-native - addressed in versions 0.77.0-1.fc34, 0.77.0-1.fc35, 0.77.0-1.fc36
rust-cranelift-frontend - addressed in versions 0.77.0-1.fc34, 0.77.0-1.fc35, 0.77.0-1.fc36
rust-cranelift-entity - addressed in versions 0.77.0-1.fc34, 0.77.0-1.fc35, 0.77.0-1.fc36
rust-cranelift-codegen-shared - addressed in versions 0.77.0-1.fc34, 0.77.0-1.fc35, 0.77.0-1.fc36
rust-cranelift-codegen-meta - addressed in versions 0.77.0-1.fc34, 0.77.0-1.fc35, 0.77.0-1.fc36
rust-cranelift-codegen - addressed in versions 0.77.0-1.fc34, 0.77.0-1.fc35, 0.77.0-1.fc36
rust-cranelift-bforest - addressed in versions 0.77.0-1.fc34, 0.77.0-1.fc35, 0.77.0-1.fc36
rust-wasmparser - addressed in versions 0.80.1-1.fc34, 0.80.1-1.fc35, 0.80.1-1.fc36
rust-wat - addressed in versions 1.0.40-1.fc34, 1.0.40-1.fc35, 1.0.40-1.fc36
rust-wast - addressed in versions 38.0.0-2.fc34, 38.0.0-2.fc35, 38.0.0-2.fc36

• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-v4cp-h94r-m7xf
• https://github.com/advisories/GHSA-v4cp-h94r-m7xf

• Multiple vulnerabilities in Wasmtime
• Fedora 36 update for rust-addr2line, rust-backtrace, rust-cranelift-bforest, rust-cranelift-codegen, rust-cranelift-codegen-meta, rust-cranelift-codegen-shared, rust-cranelift-entity, rust-cranelift-frontend, rust-cranelift-native, rust-gimli, rust-object
• Fedora 35 update for rust-addr2line, rust-backtrace, rust-cranelift-bforest, rust-cranelift-codegen, rust-cranelift-codegen-meta, rust-cranelift-codegen-shared, rust-cranelift-entity, rust-cranelift-frontend, rust-cranelift-native, rust-cranelift-wasm, ru
• Fedora 34 update for rust-addr2line, rust-backtrace, rust-cranelift-bforest, rust-cranelift-codegen, rust-cranelift-codegen-meta, rust-cranelift-codegen-shared, rust-cranelift-entity, rust-cranelift-frontend, rust-cranelift-native, rust-cranelift-wasm, ru