GHSA-5fhj-g3p3-pq9g CVE-2022-31146 RUSTSEC-2022-0100
Wasmtime vulnerable to Use After Free with `externref`s
- Severity
- 6.4 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 1.25%
- Chance of exploitation in the next 30 days. Higher than 69.41% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-416 Use After Free
- Fix
- Available
- 2 packages have a fixed version
Description
There is a bug in Wasmtime's code generator, Cranelift, where functions using reference types may be incorrectly missing metadata required for runtime garbage collection (GC). This means that if a GC happens at runtime then the collector will mistakenly think some Wasm stack frames do not have live references to garbage collected values and therefore reclaim and deallocate them. The function can then subsequently continue to use the values, leading later to use-after-free bugs. This bug was introduced in Cranelift's migration to the regalloc2 register allocator in the Wasmtime 0.37.0 release on 2022-05-20. This bug has been patched and users should upgrade to Wasmtime version 0.38.2.
Mitigations for this issue can be achieved by doing one of:
- Disabling the reference types proposal by passing
falsetowasmtime::Config::wasm_reference_types. - Downgrading to Wasmtime 0.36.0 or prior.
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| cranelift-codegen | >= 0.84.0, < 0.85.2 |
0.85.2 |
| wasmtime | >= 0.37.0, < 0.38.2 |
0.38.2 |
| wasmtime | >= 0.0.0-0, < 0.38.2 |
0.38.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
cranelift-codegen crates.io → 0.85.2
- cargo
cargo update -p cranelift-codegen --precise 0.85.2
wasmtime crates.io → 0.38.2
- cargo
cargo update -p wasmtime --precise 0.38.2
Severity breakdown
CVSS 3.1 6.4
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- Low
- Availability
- Low
Weakness
CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
How to prevent it
- Architecture and Design: Choose a language that provides automatic memory management.
- Implementation: When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| RUSTSEC-2026-0424 Unchecked memory usage in transferring borrowed resources between components | Not rated yet | Also affects wasmtime |
| RUSTSEC-2026-0423 Cross-engine type confusion with host-created struct-types-with-supertypes | Not rated yet | Also affects wasmtime |
| RUSTSEC-2026-0422 Typed functions with `i31` or `nullref` arguments may panic due to insufficient type-check | Low | Also affects wasmtime |
| RUSTSEC-2026-0379 Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction | Critical | Also affects wasmtime |
| GHSA-9pvw-hwfg-92h5 Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type | Medium | Also affects wasmtime |
| GHSA-897f-g5gm-fmxm Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation | Critical | Also affects wasmtime |
| RUSTSEC-2026-0364 Exception tags can cause host data structures to be unaligned | Not rated yet | Also affects wasmtime |
| RUSTSEC-2026-0363 Component-model handle tables are capped only per instance and charged to no limit | Medium | Also affects wasmtime |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor