Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2022-39393

Date: November 9, 2022

Wasmtime is a standalone runtime for WebAssembly. Prior to versions 2.0.2 and 1.0.2, there is a bug in Wasmtime's implementation of its pooling instance allocator where when a linear memory is reused for another instance the initial heap snapshot of the prior instance can be visible, erroneously to the next instance. This bug has been patched and users should upgrade to Wasmtime 2.0.2 and 1.0.2. Other mitigations include disabling the pooling allocator and disabling the "memory-init-cow".

Language: RUST

Severity Score

Related Resources (10)

https://rustsec.org/advisories/RUSTSEC-2022-0098.html
https://crates.io/crates/wasmtime
https://rustsec.org/advisories/RUSTSEC-2022-0075.html
https://github.com/bytecodealliance/wasmtime
https://nvd.nist.gov/vuln/detail/CVE-2022-39393
https://groups.google.com/a/bytecodealliance.org/g/sec-announce/c/c1HBDDJwNPA
https://github.com/bytecodealliance/wasmtime/commit/2614f2e9d2d36805ead8a8da0fa0c6e0d9e428a0
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wh6w-3828-g9qf
https://github.com/bytecodealliance/wasmtime/commit/3535acbf3be032ef1ba0b469b8ab92538a8a18a6
https://www.mend.io/vulnerability-database/CVE-2022-39393

Severity Score

Weakness Type (CWE)

Improper Removal of Sensitive Information Before Storage or Transfer

CWE-212

Sensitive Information in Resource Not Removed Before Reuse

CWE-226

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): CHANGED
Confidentiality (C): HIGH
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us