Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 36.0.19, 48.0.7, 49.0.4
- Public exploit
- None on Exploit-DB
Summary
Wasmtime, a WebAssembly runtime, is affected when its Cranelift compiler runs on aarch64 (ARM64) systems and compiles a WebAssembly `br_table` instruction with a very large number of targets. The resulting incorrect branch can jump to unintended code, potentially allowing a malicious WebAssembly module to escape its sandbox.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.
Affected versions
- bytecodealliance wasmtime
fixed in 36.0.19; From 37.0.0 · fixed in 48.0.7; From 49.0.0 · fixed in 49.0.4