Wasmtime 6.0.1, 5.0.1, da 4.0.1 sabunta gyara suna gyara raunin (CVE-2023-26489), wanda aka ƙididdige shi mai mahimmanci. Rashin lahani yana ba da damar tsara bayanan rubutawa zuwa wurin ƙwaƙwalwar ajiya a waje da iyakokin da aka ba da izini don keɓantaccen lambar WebAssembly, wanda mai yuwuwar maharin zai iya amfani da shi don tsara aiwatar da lambar su a wajen keɓe muhallin WASI.
Wasmtime shine lokacin gudu don gudanar da aikace-aikacen WebAssembly tare da kari na WASI (WebAssembly System Interface) azaman aikace-aikace na yau da kullun. An rubuta kayan aikin a cikin Rust, kuma raunin yana faruwa ta hanyar kuskuren ma'ana a cikin ma'anar ƙa'idodin magana da ƙwaƙwalwar layi a cikin janareta na lambar Cranelift, wanda ke fassara matsakaicin wakilci mai zaman kansa na gine-ginen kayan masarufi zuwa lambar injin aiwatarwa don gine-ginen x86_64.
Musamman ma, an ƙididdige adiresoshin masu tasiri na 35-bit don aikace-aikacen WebAssembly maimakon adiresoshin 33-bit da aka yarda a cikin WebAssembly, wanda ya canza iyakar ƙwaƙwalwar ajiyar da aka ba da izini don karantawa da rubuta ayyukan zuwa 34 GB, yayin da saitunan yanayin yanayin sandbox suna ba da kariya ga 6 GB. daga adireshin tushe. A sakamakon haka, kewayon ƙwaƙwalwar ajiya daga 6 zuwa 34 GB daga adireshin tushe yana samuwa don karantawa da rubutu daga aikace-aikacen WebAssembly. Wannan ƙwaƙwalwar ajiyar na iya ɗaukar wasu mahallin Gidan Gidan Yanar Gizo ko abubuwan haɗin lokacin aiki na Gidan Yanar Gizo.
Idan ba zai yiwu a sabunta sigar Wasmtime ba, ƙididdige zaɓin "Config :: static_memory_maximum_size(0)" don ba da damar duba iyakoki daban-daban na wajibi akan kowane damar ƙwaƙwalwar ajiyar layi ana ambata azaman hanyoyin aiki don toshe kuskure (sakamakon babban lalacewar aiki). Wani zaɓi shine a yi amfani da saitin "Config :: static_memory_guard_size (1 <36)" don ƙara yawan shafukan gadi (Shafin Tsaro, ana jefa banda lokacin da aka isa) wanda ke cikin kewayon ƙwaƙwalwar ajiya mai matsala (yana kaiwa ga tanadin adadi mai yawa). Ƙwaƙwalwar ƙwaƙwalwar ajiya da iyakance adadin aikace-aikacen WebAssembly na lokaci guda).
source: budenet.ru