Skip to content

Out-of-bounds read/write and invalid free with `externref`s and GC safepoints in Wasmtime

Moderate severity GitHub Reviewed Published Sep 17, 2021 in bytecodealliance/wasmtime • Updated Jun 13, 2023

Package

cargo wasmtime (Rust)

Affected versions

>= 0.26.0, < 0.30.0

Patched versions

0.30.0

Description

Impact

There was an invalid free and out-of-bounds read and write bug when running Wasm that uses externrefs in Wasmtime.

To trigger this bug, Wasmtime needs to be running Wasm that uses externrefs, the host creates non-null externrefs, Wasmtime performs a garbage collection (GC), and there has to be a Wasm frame on the stack that is at a GC safepoint where

  • there are no live references at this safepoint, and
  • there is a safepoint with live references earlier in this frame's function.

Under this scenario, Wasmtime would incorrectly use the GC stack map for the safepoint from earlier in the function instead of the empty safepoint. This would result in Wasmtime treating arbitrary stack slots as externrefs that needed to be rooted for GC. At the next GC, it would be determined that nothing was referencing these bogus externrefs (because nothing could ever reference them, because they are not really externrefs) and then Wasmtime would deallocate them and run <ExternRef as Drop>::drop on them. This results in a free of memory that is not necessarily on the heap (and shouldn't be freed at this moment even if it was), as well as potential out-of-bounds reads and writes.

Even though support for externrefs (via the reference types proposal) is enabled by default, unless you are creating non-null externrefs in your host code or explicitly triggering GCs, you cannot be affected by this bug.

We have reason to believe that the effective impact of this bug is relatively small because usage of externref is currently quite rare.

Patches

This bug has been patched and users should upgrade to Wasmtime version 0.30.0.

Additionally, we have updated our primary externref fuzz target such that it better exercises these code paths and we can have greater confidence in their correctness going forward.

Workarounds

If you cannot upgrade Wasmtime at this time, you can avoid this bug by disabling the reference types proposal by passing false to wasmtime::Config::wasm_reference_types

References

For more information

If you have any questions or comments about this advisory:

References

@fitzgen fitzgen published to bytecodealliance/wasmtime Sep 17, 2021
Reviewed Sep 17, 2021
Published by the National Vulnerability Database Sep 17, 2021
Published to the GitHub Advisory Database Sep 20, 2021
Last updated Jun 13, 2023

Severity

Moderate

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Local
Attack complexity
High
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

EPSS score

0.045%
(15th percentile)

CVE ID

CVE-2021-39218

GHSA ID

GHSA-4873-36h9-wv49

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.