Wasmtime 6.0.1, 5.0.1, ndi 4.0.1 zosintha zowongolera zimakonza chiwopsezo (CVE-2023-26489), chomwe chidavotera Zovuta. Chiwopsezochi chimalola kukonza zolemba za data kumalo okumbukira kunja kwa malire omwe amaloledwa kukhala ndi code ya WebAssembly yokhayo, yomwe ingagwiritsidwe ntchito ndi wowukira kuti akonzekere kuchitidwa kwa code yawo kunja kwa malo akutali a WASI.
Wasmtime ndi nthawi yothamanga yoyendetsera mapulogalamu a WebAssembly okhala ndi WASI (WebAssembly System Interface) zowonjezera ngati ntchito zodziyimira zokha. Zolembazo zidalembedwa mu Rust, ndipo kusatetezekaku kumayambitsidwa ndi kulakwitsa koyenera pakutanthauzira kwa mzere wowongolera kukumbukira malamulo mu jenereta ya Cranelift code generator, yomwe imatanthawuza chiwonetsero chapakatikati chodziyimira pawokha chodziyimira pawokha pamakina a hardware kukhala makina ogwiritsiridwa ntchito a x86_64.
Makamaka, ma adilesi ogwira ntchito a 35-bit adawerengeredwa pamapulogalamu a WebAssembly m'malo mwa ma adilesi a 33-bit omwe amaloledwa mu WebAssembly, omwe adasintha malire a kukumbukira komwe amaloledwa kuwerenga ndi kulemba ku 34 GB, pomwe zosintha za sandbox zimateteza 6 GB. kuchokera ku adilesi yoyambira. Zotsatira zake, kuchuluka kwa kukumbukira kochokera ku 6 mpaka 34 GB kuchokera ku adilesi yoyambira kunalipo powerenga ndi kulemba kuchokera ku mapulogalamu a WebAssembly. Chikumbutsochi chikhoza kuchititsa madera ena a WebAssembly kapena zigawo za nthawi ya WebAssembly.
Ngati sikutheka kukonzanso mtundu wa Wasmtime, kutchula njira ya "Config::static_memory_maximum_size(0)" kuti mutsegule malire ofunikira kuti muwonetsetse mwayi uliwonse wamakumbukidwe amatchulidwa ngati njira zogwirira ntchito kuti aletse cholakwikacho (zimabweretsa kuwonongeka kwakukulu kwa magwiridwe antchito). Njira ina ndikugwiritsa ntchito zoikamo "Config::static_memory_guard_size(1 <36)" kuti muwonjezere kuchuluka kwa masamba achitetezo (Tsamba la Guard, chosiyana chimaponyedwa chikapezeka) chomwe chili mumtundu wamavuto omwe amakumbukira (amatsogolera kusungitsa ndalama zambiri. kukumbukira kwenikweni ndikuchepetsa kugwiritsa ntchito WebAssembly munthawi yomweyo).
Source: opennet.ru