CVE-2022-39393

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-39393
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-39393.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-39393
Aliases
Downstream
Published
2022-11-10T00:00:00Z
Modified
2025-12-04T10:36:38.639903Z
Severity
  • 8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
Summary
Wasmtime vulnerable to data leakage between instances in the pooling allocator
Details

Wasmtime is a standalone runtime for WebAssembly. Prior to versions 2.0.2 and 1.0.2, there is a bug in Wasmtime's implementation of its pooling instance allocator where when a linear memory is reused for another instance the initial heap snapshot of the prior instance can be visible, erroneously to the next instance. This bug has been patched and users should upgrade to Wasmtime 2.0.2 and 1.0.2. Other mitigations include disabling the pooling allocator and disabling the memory-init-cow.

Database specific 
{
    "cwe_ids": [
        "CWE-226"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39393.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/bytecodealliance/wasmtime

Affected ranges

Type
GIT
Repo
https://github.com/bytecodealliance/wasmtime
Events
Introduced
ff8c568eeed3918a5d591295e9384e2b1e462aae
Fixed
a528e0383e1177119a6c985dac1972513df11a03
Database specific 
{
    "versions": [
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.0.2"
        }
    ]
}
Type
GIT
Repo
https://github.com/bytecodealliance/wasmtime
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
15991947f485a60298e45d1d915125c0f3cc5a8a
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.0.2"
        }
    ]
}

Affected versions

cranelift-v0.*

cranelift-v0.60.0
cranelift-v0.61.0
cranelift-v0.69.0

filecheck-v0.*

filecheck-v0.0.1

v0.*

v0.12.0
v0.16.0
v0.17.0
v0.18.0
v0.19.0
v0.20.0
v0.21.0
v0.22.0
v0.23.0
v0.24.0
v0.25.0
v0.26.0
v0.27.0
v0.28.0
v0.29.0
v0.30.0
v0.31.0
v0.32.0
v0.33.0
v0.34.0
v0.35.0

v1.*

v1.0.0
v1.0.1

v2.*

v2.0.0
v2.0.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-39393.json"