Negli aggiornamenti correttivi di Wasmtime 6.0.1, 5.0.1 e 4.0.1 \u00e8 stata risolta una vulnerabilit\u00e0 (CVE-2023-26489) classificata come critica. Questa vulnerabilit\u00e0 consente di effettuare la scrittura di dati in aree di memoria al di fuori dei limiti consentiti per il codice WebAssembly isolato, il che potrebbe essere sfruttato da un attaccante per eseguire il proprio codice al di fuori dell'ambiente isolato WASI. <\/p>\n
Wasmtime \u00e8 un runtime per l'esecuzione di applicazioni WebAssembly con estensioni WASI (WebAssembly System Interface) come comuni applicazioni isolate. Il toolkit \u00e8 sviluppato in Rust e la vulnerabilit\u00e0 \u00e8 causata da un errore logico nella definizione delle regole di indirizzamento della memoria nel generatore di codice Cranelift, che traduce una rappresentazione intermedia indipendente dall'architettura hardware in codice macchina eseguibile per l'architettura x86_64. <\/p>\n
In particolare, per le applicazioni WebAssembly sono stati calcolati indirizzi efficaci a 35 bit invece degli indirizzi a 33 bit consentiti da WebAssembly, spostando il limite consentito per le operazioni di lettura e scrittura della memoria virtuale fino a 34 GB, mentre le impostazioni dell'ambiente sandbox forniscono protezione per 6 GB dall'indirizzo di base. Di conseguenza, l'intervallo di memoria virtuale da 6 a 34 GB dall'indirizzo di base risultava accessibile per lettura e scrittura dalle applicazioni WebAssembly. In questa memoria possono trovarsi altri ambienti WebAssembly o componenti del runtime WebAssembly. <\/p>\n
Se non \u00e8 possibile aggiornare la versione di Wasmtime, come soluzione per bloccare l'errore viene citata l'opzione «Config::static_memory_maximum_size(0)» per attivare una verifica separata dei confini in caso di accesso alla memoria lineare (comporta una significativa riduzione delle prestazioni). Un'altra opzione \u00e8 utilizzare l'impostazione «Config::static_memory_guard_size(1 < 36)» per aumentare il numero di pagine di guardia della memoria (Guard Page, un'eccezione viene generata all'accesso), collocate nell'intervallo problematico della memoria virtuale (comporta la riservazione di un grande volume di memoria virtuale e limita il numero di applicazioni WebAssembly che possono essere eseguite contemporaneamente). \u0412 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\u0445 Wasmtime 6.0.1, 5.0.1 \u0438 4.0.1 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-26489), \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0437\u0430\u043f\u0438\u0441\u044c \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u044c \u043f\u0430\u043c\u044f\u0442\u0438 \u0432\u043d\u0435 \u0433\u0440\u0430\u043d\u0438\u0446\u044b, \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u043e\u0439 \u0434\u043b\u044f \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e WebAssembly-\u043a\u043e\u0434\u0430, \u0447\u0442\u043e \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u043e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0432\u043d\u0435 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f WASI. Wasmtime \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 runtime \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f WebAssembly-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0441 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f\u043c\u0438 WASI […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-107183","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u00e0 critica in Wasmtime, runtime per applicazioni WebAssembly | ProHoster","description":"Negli aggiornamenti correttivi Wasmtime 6.0.1, 5.0.1 e 4.0.1 \u00e8 stata risolta una vulnerabilit\u00e0 (CVE-2023-26489) classificata con un livello critico di pericolosit\u00e0.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/news\/kriticheskaya-uyazvimost-v-wasmtime-runtime-dlya-webassembly-prilozhenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Wasmtime, runtime \u0434\u043b\u044f WebAssembly-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u0412 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\u0445 Wasmtime 6.0.1, 5.0.1 \u0438 4.0.1 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-26489), \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/it\/blog\/news\/kriticheskaya-uyazvimost-v-wasmtime-runtime-dlya-webassembly-prilozhenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-03-10T16:48:11+00:00","article:modified_time":"2023-03-13T10:06:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/107183","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=107183"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/107183\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=107183"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=107183"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=107183"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"