Access of Uninitialized Pointer Affecting wasmtime package, versions <0.33.1 >=0.34.0 <0.34.1
Threat Intelligence
EPSS
0.24% (63rd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUST-WASMTIME-2404187
- published 17 Feb 2022
- disclosed 17 Feb 2022
- credit Peter Huene
Introduced: 17 Feb 2022
CVE-2022-23636 Open this link in a new tabHow to fix?
Upgrade wasmtime to version 0.33.1, 0.34.1 or higher.
Overview
Affected versions of this package are vulnerable to Access of Uninitialized Pointer when the instance of a module that defines an externref global will result in an invalid drop of the VMExternRef.
Note: If it is not possible to upgrade to the fixed versions, it is recommend that the support for the reference types proposal will be disabled by passing false to Config::wasm_reference_types. It will will prevent modules that use externref from being loaded entirely.
References
CVSS Scores
version 3.1