Off-by-one Error Affecting wasmtime package, versions >=1.0.0 <4.0.1 >=5.0.0 <5.0.1 >=6.0.0 <6.0.1
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUST-WASMTIME-3357686
- published 9 Mar 2023
- disclosed 9 Mar 2023
- credit afonso360
Introduced: 9 Mar 2023
CVE-2023-27477 Open this link in a new tabHow to fix?
Upgrade wasmtime to version 4.0.1, 5.0.1, 6.0.1 or higher.
Overview
Affected versions of this package are vulnerable to Off-by-one Error in the calculation of the mask to the pshufb instruction.
The vulnerability exists due to a bug on x86_64 platforms for the WebAssembly i8x16.select instruction, which will produce the wrong results when the same operand is provided to the instruction and some of the selected indices are greater than 16.
Workaround
If upgrading is not an option for you at this time, you can avoid this miscompilation by disabling the Wasm simd proposal
config.wasm_simd(false);
Additionally, the bug is only present on x86_64 hosts. Other platforms such as AArch64 and s390x are not affected.