In the corrective updates of Wasmtime 6.0.1, 5.0.1, and 4.0.1, a vulnerability (CVE-2023-26489) has been fixed, which has been assigned a critical risk level. This vulnerability allows unauthorized data to be written in memory areas outside the boundaries permitted for isolated WebAssembly code, which could potentially be exploited by an attacker to execute their code outside the WASI isolated environment.
Wasmtime is a runtime for executing WebAssembly applications with WASI (WebAssembly System Interface) extensions, functioning like ordinary isolated applications. The toolkit is written in Rust, and the vulnerability was caused by a logical error in determining the memory linear addressing rules in the Cranelift code generator, which translates architecture-independent intermediate representations into executable machine code for the x86_64 architecture.
Specifically, effective 35-bit addresses were calculated for WebAssembly applications instead of the 33-bit addresses allowed in WebAssembly, shifting the boundary of permissible reading and writing operations in virtual memory to 34 GB, while the sandbox environment settings provide protection for 6 GB from the base address. As a result, the range of virtual memory from 6 to 34 GB from the base address became accessible for reading and writing by WebAssembly applications. This memory can contain other WebAssembly environments or components of the WebAssembly runtime.
If it is impossible to update the version of Wasmtime, workarounds to block the error include setting the option "Config::static_memory_maximum_size(0)" to enable mandatory checks of memory boundaries during any access to linear memory (leading to a significant performance decrease). Another option is to use the setting "Config::static_memory_guard_size(1 < 36)" to increase the number of guard pages in the problematic range of virtual memory (resulting in the reservation of a large amount of virtual memory and limiting the number of concurrently running WebAssembly applications).
Source: opennet.ru
