Threats tagged 'ghsa-2hw9-mc66-jc2q'

Wasmtime, a WebAssembly runtime, contains a vulnerability in its handling of bulk-data-transfer instructions like memory.copy when combined with preemption via epochs or fuel and store state mutations or computation cancellations. This can lead to exposure of intermediate internal states, causing semantic inconsistencies and potential segfaults. The issue affects embedders using Store::epoch_deadline_callback and performing store mutations or resuming computations after cancellation. Wasmtime versions 46.0.0 up to but not including 46.0.2 and 47.0.0 up to but not including 47.0.3 are affected. The vulnerability is fixed in versions 46.0.2 and 47.0.3 by reverting to a behavior that avoids preemption points during these operations.