GHSA-7f6x-jwh5-m9r4 CVE-2022-23636 CVE-2022-31169 GHSA-88xq-w8cq-xfg7 RUSTSEC-2022-0096 RUSTSEC-2022-0101
Cranelift vulnerable to miscompilation of constant values in division on AArch64
- Severity
- 5.9 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.92%
- Chance of exploitation in the next 30 days. Higher than 60.42% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-682 Incorrect Calculation
- Fix
- Available
- 2 packages have a fixed version
Description
Impact
There was a bug in Wasmtime's code generator, Cranelift, for AArch64 targets where constant divisors could result in incorrect division results at runtime. The translation rules for constants did not take into account whether sign- or zero-extension should happen, which resulted in an incorrect value being placed into a register when a division was encountered. For example, a constant 32-bit unsigned divisor of 0xfffffffe would be incorrectly sign-extended to 64-bits to 0xfffffffffffffffe. Any kind of division of operands smaller than 64 bits is implemented with a 64-bit division instruction which would then result in an incorrect result because the divisor was larger than expected.
The impact of this bug is that programs executing within the WebAssembly sandbox would not behave according to the WebAssembly specification. This means that it is hypothetically possible for execution within the sandbox to go awry and WebAssembly programs could produce unexpected results. This should not impact hosts executing WebAssembly, but does affect the correctness of guest programs.
This bug was found with differential fuzzing of Wasmtime against other engines on the AArch64 platform. Fuzzing on AArch64 is not regularly performed at this time and the Wasmtime team is investigating how best to continuously fuzz AArch64 in the same manner as x86_64.
Patches
This bug has been patched and users should upgrade to Wasmtime version 0.38.2.
Workarounds
If upgrading is not an option at this time, direct users of Cranelift that control the exact Cranelift instructions being compiled can avoid the vulnerability by explicitly extending constant divisors to 64 bits using either the sextend.i64 or the uextend.i64 operation.
Note, though, that this issue only affects the AArch64 targets. Other platforms are not affected.
For more information
If you have any questions or comments about this advisory:
- Reach out to us on the Bytecode Alliance Zulip chat
- Open an issue in the bytecodealliance/wasmtime repository
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| cranelift-codegen | < 0.85.2 |
0.85.2 |
| wasmtime | < 0.38.2 |
0.38.2 |
| wasmtime | >= 0.34.0, < 0.34.1 |
0.34.1 |
| wasmtime | < 0.33.1 |
0.33.1 |
| wasmtime | >= 0.0.0-0, < 0.33.1>= 0.34.0, < 0.34.1 |
0.33.10.34.1 |
| wasmtime | >= 0.0.0-0, < 0.38.2 |
0.38.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
cranelift-codegen crates.io → 0.85.2
- cargo
cargo update -p cranelift-codegen --precise 0.85.2
wasmtime crates.io → 0.38.2
- cargo
cargo update -p wasmtime --precise 0.38.2
Severity breakdown
CVSS 3.1 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Weakness
CWE-682: Incorrect Calculation
The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.
How to prevent it
- Implementation: Understand your programming language's underlying representation and how it interacts with numeric calculation. Pay close attention to byte size discrepancies, precision, signed/unsigned distinctions, truncation, conversion and casting between types, "not-a-number" calculations, and how your language handles numbers that are too large or too small for its underlying representation.
- Implementation: Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.
- Implementation: Use the appropriate type for the desired action. For example, in C/C++, only use unsigned types for values that could never be negative, such as height, width, or other numbers related to quantity.
- Architecture and Design: Use languages, libraries, or frameworks that make it easier to handle numbers without unexpected consequences. Examples include safe integer handling packages such as SafeInt (C++) or IntegerLib (C or C++).
- Architecture and Design: Use languages, libraries, or frameworks that make it easier to handle numbers without unexpected consequences. Examples include safe integer handling packages such as SafeInt (C++) or IntegerLib (C or C++).
- Implementation: Examine compiler warnings closely and eliminate problems with potential security implications, such as signed / unsigned mismatch in memory operations, or use of uninitialized variables. Even if the weakness is rarely exploitable, a single failure may lead to the compromise of the entire system.
References
Advisories
Packages
Other links
- github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7f6x-jwh5-m9r4
- github.com/bytecodealliance/wasmtime/commit/2ba4bce5cc719e5a74e571a534424614e62…
- rustsec.org/advisories/RUSTSEC-2022-0101.html
- github.com/bytecodealliance/wasmtime/security/advisories/GHSA-88xq-w8cq-xfg7
- github.com/bytecodealliance/wasmtime/commit/886ecc562040bef61faf19438c22285c2d6…
- rustsec.org/advisories/RUSTSEC-2022-0096.html
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| RUSTSEC-2026-0424 Unchecked memory usage in transferring borrowed resources between components | Not rated yet | Also affects wasmtime |
| RUSTSEC-2026-0423 Cross-engine type confusion with host-created struct-types-with-supertypes | Not rated yet | Also affects wasmtime |
| RUSTSEC-2026-0422 Typed functions with `i31` or `nullref` arguments may panic due to insufficient type-check | Low | Also affects wasmtime |
| RUSTSEC-2026-0379 Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction | Critical | Also affects wasmtime |
| GHSA-9pvw-hwfg-92h5 Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type | Medium | Also affects wasmtime |
| GHSA-897f-g5gm-fmxm Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation | Critical | Also affects wasmtime |
| RUSTSEC-2026-0364 Exception tags can cause host data structures to be unaligned | Not rated yet | Also affects wasmtime |
| RUSTSEC-2026-0363 Component-model handle tables are capped only per instance and charged to no limit | Medium | Also affects wasmtime |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor