RUSTSEC-2022-0075

Source
https://rustsec.org/advisories/RUSTSEC-2022-0075
Import Source
https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2022-0075.json
Aliases
Published
2022-11-10T12:00:00Z
Modified
2023-11-08T04:10:20.896620Z
Details

bug in Wasmtime's implementation of its pooling instance allocator where when a linear memory is reused for another instance the initial heap snapshot of the prior instance can be visible, erroneously to the next instance.

Mitigations are described here.

References

Affected packages

crates.io / wasmtime

Package

Name
wasmtime

Affected ranges

Type
SEMVER
Events
Introduced
0.0.0-0
Fixed
1.0.2
Introduced
2.0.0
Fixed
2.0.2

Ecosystem specific 

{
    "affects": {
        "os": [],
        "functions": [],
        "arch": []
    }
}

Database specific 

{
    "cvss": null,
    "informational": null,
    "categories": [
        "memory-exposure"
    ]
}