Two critical flaws in Wasmtime, a WebAssembly runtime that can be built into other software, could allow a malicious WebAssembly module to escape the sandbox intended to contain it, the project's maintainers say.

An attacker would first need a vulnerable Wasmtime build to compile a module they control, and one of the flaws affects only ARM64 systems. Fixed versions were released on October 19 and 20, and the maintainers have not reported any attacks.

Wasmtime runs WebAssembly code outside web browsers. Both bugs are in Cranelift, the compiler it uses by default to turn WebAssembly into machine code. Wasmtime's maintainers at the Bytecode Alliance rated each flaw 9.9 out of 10 on the CVSS scale in advisories published on October 19.

The sandbox is meant to keep a module inside set limits. A module can only use its own memory and the host functions it is given, and its code can only jump to checked locations.

Because both flaws need a module the attacker controls, the risk is highest for services that compile modules written by other people. Fastly, for example, says its Compute platform runs customer code using Wasmtime. The advisories do not name any affected services or specify what an attacker could access after escaping the sandbox.

Neither flaw was in the Known Exploited Vulnerabilities catalog kept by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) as of October 26.

The two flaws were fixed at different times, so whether your version is affected depends on your release line and, for one flaw, your processor architecture.

Source link