Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
Résumé
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary oth...
Résumé IA
Rédigé par une IA externe ; il peut contenir des erreurs. Vérifiez la description d'origine et les références ci-dessous avant d'agir.
WebAssembly 実行環境 Wasmtime の aarch64 版で、細工された Wasm モジュールがサンドボックスを抜け出せる可能性がある脆弱性が公表されました。外部から受け取った Wasm を aarch64 上で実行している組織が対象で、36.0.19、48.0.7、49.0.4 のいずれかへの更新が必要です。実際の攻撃での悪用が確認されたという情報は、現時点では見当たりません。
Paquets affectés
| Écosystème | Paquet | Concernées | Corrigé |
|---|---|---|---|
| bytecodealliance | wasmtime | — | — |
Description d'origine La description telle que publiée par la source (souvent en anglais).
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.
Source: CVE.org (CVE Program・cvelistV5) NVD
Références
- web security-advisories@github.com
- web security-advisories@github.com
- web security-advisories@github.com
- web security-advisories@github.com
- web security-advisories@github.com
- web security-advisories@github.com
- web security-advisories@github.com
- web security-advisories@github.com
- web security-advisories@github.com
- web security-advisories@github.com
- web security-advisories@github.com
- web security-advisories@github.com