Vulnerability Details : CVE-2022-39393
Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's implementation of its pooling instance allocator where when a linear memory is reused for another instance the initial heap snapshot of the prior instance can be visible, erroneously to the next instance. This bug has been patched and users should upgrade to Wasmtime 2.0.2. Other mitigations include disabling the pooling allocator and disabling the `memory-init-cow`.
Exploit prediction scoring system (EPSS) score for CVE-2022-39393
Probability of exploitation activity in the next 30 days: 0.12%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 46 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2022-39393
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
8.6
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
3.9
|
4.0
|
NIST |
|
8.6
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
3.9
|
4.0
|
GitHub, Inc. |
CWE ids for CVE-2022-39393
-
The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.Assigned by: nvd@nist.gov (Primary)
-
The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.Assigned by: security-advisories@github.com (Secondary)
References for CVE-2022-39393
-
https://github.com/bytecodealliance/wasmtime/commit/2614f2e9d2d36805ead8a8da0fa0c6e0d9e428a0
Merge pull request from GHSA-wh6w-3828-g9qf · bytecodealliance/wasmtime@2614f2e · GitHubPatch;Third Party Advisory
-
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wh6w-3828-g9qf
Data leakage between instances in the pooling allocator · Advisory · bytecodealliance/wasmtime · GitHubThird Party Advisory
Products affected by CVE-2022-39393
- cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:*
- cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:*