Wasmtime 6.0.1, 5.0.1, thiab 4.0.1 kho kho tshiab kho qhov tsis zoo (CVE-2023-26489), uas tau raug ntsuas qhov tseem ceeb. Qhov tsis zoo no tso cai rau kev teeb tsa cov ntaub ntawv sau rau thaj chaw nco sab nraud ciam teb tso cai rau kev cais WebAssembly code, uas tuaj yeem siv los ntawm tus neeg tawm tsam los teeb tsa kev ua tiav ntawm lawv cov cai sab nraud WASI ib puag ncig.
Wasmtime yog lub sijhawm ua haujlwm rau kev khiav WebAssembly daim ntawv thov nrog WASI (WebAssembly System Interface) txuas ntxiv raws li cov ntawv thov ib txwm muaj. Cov cuab yeej yog sau rau hauv Rust, thiab qhov tsis zoo yog tshwm sim los ntawm kev ua yuam kev hauv lub ntsiab lus ntawm cov kab ntawv cim xeeb hais txog cov cai hauv Cranelift code generator, uas txhais cov neeg sawv cev nruab nrab ntawm cov khoom siv kho vajtse rau hauv lub tshuab ua haujlwm rau x86_64 architecture.
Tshwj xeeb, 35-ntsis chaw nyob zoo tau suav rau WebAssembly daim ntawv thov hloov 33-ntsis chaw nyob tau tso cai hauv WebAssembly, uas hloov qhov txwv ntawm lub cim xeeb virtual tso cai rau kev nyeem thiab sau ua haujlwm rau 34 GB, thaum lub sandbox ib puag ncig chaw muab kev tiv thaiv rau 6 GB. los ntawm lub hauv paus chaw nyob. Yog li ntawd, qhov ntau ntawm lub cim xeeb virtual los ntawm 6 mus rau 34 GB los ntawm qhov chaw nyob hauv paus muaj rau kev nyeem ntawv thiab sau ntawv los ntawm WebAssembly daim ntawv thov. Lub cim xeeb no tuaj yeem tuav lwm qhov WebAssembly ib puag ncig lossis WebAssembly runtime Cheebtsam.
Yog tias nws tsis tuaj yeem hloov kho Wasmtime version, qhia txog qhov "Config:: static_memory_maximum_size(0)" kev xaiv los ua kom muaj qhov yuav tsum tau cais cov ciam teb txheeb xyuas ntawm ib qho kev nkag mus rau lub cim xeeb yog hais txog kev ua haujlwm los thaiv qhov yuam kev (ua rau muaj kev cuam tshuam loj heev). Lwm qhov kev xaiv yog siv qhov chaw "Config:: static_memory_guard_size (1 < 36)" kom nce tus naj npawb ntawm cov nplooj ntawv saib xyuas (Tus Saib Xyuas Nplooj, qhov kev zam raug pov tseg thaum nkag mus) nyob rau hauv qhov teeb meem virtual nco ntau (ua rau kom khaws nyiaj ntau. ntawm virtual nco thiab txwv tus lej concurrent WebAssembly applications).
Tau qhov twg los: opennet.ru