GHSA-75hq-h6g9-h4q5 CVE-2024-30266 PYSEC-2024-327 RUSTSEC-2024-0441
Wasmtime vulnerable to panic when using a dropped extenref-typed element segment
- Severity
- 3.3 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.32%
- Chance of exploitation in the next 30 days. Higher than 25.07% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
- Fix
19.0.1- Upgrade wasmtime to this version or later
Description
Impact
The 19.0.0 release of Wasmtime contains a regression introduced during its development which can lead to a guest WebAssembly module causing a panic in the host runtime. A valid WebAssembly module, when executed at runtime, may cause this panic. The panic in question is caused when a WebAssembly module issues a table.* instruction which uses a dropped element segment with a table that also has an externref type. This causes Wasmtime to erroneously use an empty function segment instead of an empty externref segment to perform this operation. This mismatch in types causes a panic in Wasmtime when it's asserted that an externref table is only viewed as externrefs.
This regression was introduced during the development of the 19.0.0 release and only affects the 19.0.0 release. This panic requires the reference-types WebAssembly feature to be enabled, and it is enabled by default. Toolchains are not known to generate this pattern by default so it's likely a module would need to be specifically crafted to trigger this panic.
A panic in a host runtime represents a possible denial-of-service in some scenarios. This panic cannot introduce memory unsafety or allow WebAssembly to break outside of its sandbox, however. There is no possible heap corruption or memory unsafety from this panic.
Patches
Wasmtime 19.0.1 has been released to fix this problem. Users of 19.0.0 should upgrade to 19.0.1. All other versions of Wasmtime are not affected by this issue.
Workarounds
If upgrading is not possible it's recommended to use config.reference_types(false). That will disable these modules at validation-time which prevents the possibility of a panic at runtime. If reference-types are required, however, then there is no other workaround at this time other than upgrading.
References
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| wasmtime | <= 19.0.0 |
No fix yet |
crates.io
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
wasmtime crates.io → 19.0.1
- cargo
cargo update -p wasmtime --precise 19.0.1
Severity breakdown
CVSS 3.1 3.3
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Weakness
CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
References
Advisories
Packages
Other links
- github.com/bytecodealliance/wasmtime/security/advisories/GHSA-75hq-h6g9-h4q5
- github.com/bytecodealliance/wasmtime/issues/8281
- github.com/bytecodealliance/wasmtime/pull/8018
- github.com/bytecodealliance/wasmtime/pull/8283
- github.com/bytecodealliance/wasmtime/commit/7f57d0bb0948fa56cc950278d0db230ed10…
- rustsec.org/advisories/RUSTSEC-2024-0441.html
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| RUSTSEC-2026-0424 Unchecked memory usage in transferring borrowed resources between components | Not rated yet | Also affects wasmtime |
| RUSTSEC-2026-0423 Cross-engine type confusion with host-created struct-types-with-supertypes | Not rated yet | Also affects wasmtime |
| RUSTSEC-2026-0422 Typed functions with `i31` or `nullref` arguments may panic due to insufficient type-check | Low | Also affects wasmtime |
| RUSTSEC-2026-0379 Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction | Critical | Also affects wasmtime |
| GHSA-9pvw-hwfg-92h5 Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type | Medium | Also affects wasmtime |
| GHSA-897f-g5gm-fmxm Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation | Critical | Also affects wasmtime |
| RUSTSEC-2026-0364 Exception tags can cause host data structures to be unaligned | Not rated yet | Also affects wasmtime |
| RUSTSEC-2026-0363 Component-model handle tables are capped only per instance and charged to no limit | Medium | Also affects wasmtime |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor