CVE-2021-39219

{"id": "CVE-2021-39219", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.3, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 1.0}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 1.0}]}, "published": "2021-09-17T20:15:07.763", "references": [{"url": "https://crates.io/crates/wasmtime", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/bytecodealliance/wasmtime/commit/b39f087414f27ae40c44449ed5d1154e03449bff", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q879-9g95-56mx", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAVBRYDDUIY2ZR3K3FO4BVYJKIMJ5TP7/", "source": "security-advisories@github.com"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2Z33FTXFQ6EOINVEQIP4DFBG53G5XIY/", "source": "security-advisories@github.com"}, {"url": "https://crates.io/crates/wasmtime", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/bytecodealliance/wasmtime/commit/b39f087414f27ae40c44449ed5d1154e03449bff", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q879-9g95-56mx", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAVBRYDDUIY2ZR3K3FO4BVYJKIMJ5TP7/", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2Z33FTXFQ6EOINVEQIP4DFBG53G5XIY/", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-843"}]}], "descriptions": [{"lang": "en", "value": "Wasmtime is an open source runtime for WebAssembly & WASI. Wasmtime before version 0.30.0 is affected by a type confusion vulnerability. As a Rust library the `wasmtime` crate clearly marks which functions are safe and which are `unsafe`, guaranteeing that if consumers never use `unsafe` then it should not be possible to have memory unsafety issues in their embeddings of Wasmtime. An issue was discovered in the safe API of `Linker::func_*` APIs. These APIs were previously not sound when one `Engine` was used to create the `Linker` and then a different `Engine` was used to create a `Store` and then the `Linker` was used to instantiate a module into that `Store`. Cross-`Engine` usage of functions is not supported in Wasmtime and this can result in type confusion of function pointers, resulting in being able to safely call a function with the wrong type. Triggering this bug requires using at least two `Engine` values in an embedding and then additionally using two different values with a `Linker` (one at the creation time of the `Linker` and another when instantiating a module with the `Linker`). It's expected that usage of more-than-one `Engine` in an embedding is relatively rare since an `Engine` is intended to be a globally shared resource, so the expectation is that the impact of this issue is relatively small. The fix implemented is to change this behavior to `panic!()` in Rust instead of silently allowing it. Using different `Engine` instances with a `Linker` is a programmer bug that `wasmtime` catches at runtime. This bug has been patched and users should upgrade to Wasmtime version 0.30.0. If you cannot upgrade Wasmtime and are using more than one `Engine` in your embedding it's recommended to instead use only one `Engine` for the entire program if possible. An `Engine` is designed to be a globally shared resource that is suitable to have only one for the lifetime of an entire process. If using multiple `Engine`s is required then code should be audited to ensure that `Linker` is only used with one `Engine`."}, {"lang": "es", "value": "Wasmtime es un tiempo de ejecuci\u00f3n de c\u00f3digo abierto para WebAssembly y WASI. Wasmtime versiones anteriores a 0.30.0, est\u00e1 afectado por una vulnerabilidad de confusi\u00f3n de tipo. Como librer\u00eda de Rust, la caja \"wasmtime\" marca claramente qu\u00e9 funciones son seguras y cu\u00e1les son \"unsafe\", garantizando que si los consumidores nunca usan \"unsafe\" no deber\u00eda ser posible tener problemas de inseguridad de memoria en sus inserciones de Wasmtime. Se ha detectado un problema en la API segura de las APIs \"Linker::func_*\". Estas APIs no eran seguras cuando un \"Engine\" era usado para crear el \"Linker\" y luego otro \"Engine\" era usado para crear un \"Store\" y luego el \"Linker\" era usado para instanciar un m\u00f3dulo en ese \"Store\". Un uso cruzado de funciones de \"Engine\" no est\u00e1 soportado en Wasmtime y esto puede resultar en una confusi\u00f3n de tipo de los punteros de las funciones, resultando en poder llamar de forma segura a una funci\u00f3n con el tipo equivocado. Desencadenar este bug requiere el uso de al menos dos valores de \"Engine\" en una inserci\u00f3n y, adem\u00e1s, el uso de dos valores diferentes con un \"Linker\" (uno en el momento de la creaci\u00f3n del \"Linker\" y otro cuando se instancie un m\u00f3dulo con el \"Linker\"). Se espera que el uso de m\u00e1s de un \"Engine\" en una inserci\u00f3n sea relativamente raro ya que un \"Engine\" est\u00e1 destinado a ser un recurso compartido globalmente, por lo que se espera que el impacto de este problema sea relativamente peque\u00f1o. La correcci\u00f3n implementada es cambiar este comportamiento a \"panic!()\" en Rust en lugar de permitirlo silenciosamente. El uso de diferentes instancias de \"Engine\" con un \"Linker\" es un error de programaci\u00f3n que \"wasmtime\" detecta en tiempo de ejecuci\u00f3n. Este bug ha sido parcheado y los usuarios deber\u00edan actualizar a la versi\u00f3n 0.30.0 de Wasmtime. Si no puedes actualizar Wasmtime y est\u00e1s usando m\u00e1s de un \"Engine\" en tu inserci\u00f3n, se recomienda usar s\u00f3lo un \"Engine\" para todo el programa si es posible. Un \"Engine\" est\u00e1 dise\u00f1ado para ser un recurso globalmente compartido que es adecuado para tener s\u00f3lo uno durante el tiempo de vida de un proceso entero. Si se requiere el uso de m\u00faltiples \"Engines\" entonces el c\u00f3digo debe ser auditado para asegurar que el \"Linker\" s\u00f3lo se usa con un \"Engine\""}], "lastModified": "2024-11-21T06:18:56.053", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "929B6668-A9D9-473E-A19C-EBBEC27393A0", "versionEndExcluding": "0.30.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A930E247-0B43-43CB-98FF-6CE7B8189835"}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "80E516C0-98A4-4ADE-B69F-66A772E2BAAA"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}