RUSTSEC-2022-0075

See a problem?

Source

https://rustsec.org/advisories/RUSTSEC-2022-0075

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2022-0075.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2022-0075

Aliases

Published

2022-11-10T12:00:00Z

Modified

2023-11-08T04:10:20.896620Z

Summary

Bug in pooling instance allocator

Details

bug in Wasmtime's implementation of its pooling instance allocator where when a linear memory is reused for another instance the initial heap snapshot of the prior instance can be visible, erroneously to the next instance.

Mitigations are described here.

References

Affected packages

crates.io / wasmtime

Package

Name: wasmtime; View open source insights on deps.dev
Purl: pkg:cargo/wasmtime

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

1.0.2

Introduced

2.0.0

Fixed

2.0.2

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "os": [],
        "functions": [],
        "arch": []
    }
}

Database specific

{
    "cvss": null,
    "informational": null,
    "categories": [
        "memory-exposure"
    ]
}