Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 36.0.19, 43.0.0
- Public exploit
- None on Exploit-DB
Summary
Wasmtime, a WebAssembly runtime, is affected in its Cranelift compiler backend, which can silently miscompile large or specially crafted WebAssembly functions in release builds. The resulting incorrect code could let an attacker break out of the WebAssembly sandbox on any system using the default Cranelift backend.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.
Affected versions
- bytecodealliance wasmtime
fixed in 36.0.19; From 37.0.0 · fixed in 43.0.0
- wasmtimecrates.io
From 0.0.0-0 · fixed in 36.0.19; From 37.0.0 · fixed in 43.0.0
- wasmtimecrates.io
fixed in 36.0.19
- wasmtimecrates.io
From 37.0.0 · fixed in 43.0.0