Skip to content

wasmtime vulnerable to miscompilation of `i8x16.select` with the same inputs on x86_64

Low severity GitHub Reviewed Published Mar 8, 2023 in bytecodealliance/wasmtime • Updated Mar 9, 2023

Package

cargo cranelift-codegen (Rust)

Affected versions

>= 0.88.0, < 0.91.1
>= 0.92.0, < 0.92.1
>= 0.93.0, < 0.93.1

Patched versions

0.91.1
0.92.1
0.93.1
cargo wasmtime (Rust)
>= 1.0.0, < 4.0.1
>= 5.0.0, < 5.0.1
>= 6.0.0, < 6.0.1
4.0.1
5.0.1
6.0.1

Description

Impact

Wasmtime's code generation backend, Cranelift, has a bug on x86_64 platforms for the WebAssembly i8x16.select instruction which will produce the wrong results when the same operand is provided to the instruction and some of the selected indices are greater than 16. There is an off-by-one error in the calculation of the mask to the pshufb instruction which causes incorrect results to be returned if lanes are selected from the second vector.

The impact of this miscompilation is that the WebAssembly instruction can produce incorrect results for the i8x16.select instruction. This should have no effect on embedders and does not represent a sandbox escape, for example. Guest programs, however, may behave unexpectedly due to the incorrect result of this instruction. In extreme cases if a guest program is handling untrusted input then the guest program may deviate from its intended execution, for example calling an imported host function with different arguments than intended. This still does not impact embedders, however, because there is no form of privilege escalation with the guest.

At this time it's expected that this codegen pattern doesn't show up in the wild that often. LLVM-generated modules, for example, do not appear to conventionally or idiomatically generate code which would hit this bug. It is possible, however, to still write code which triggers this, so it's recommended for embedders to analyze existing modules to see if any are affected.

Patches

This codegen bug has been fixed in Wasmtime 6.0.1, 5.0.1, and 4.0.1. Users are recommended to upgrade to these updated versions.

Workarounds

If upgrading is not an option for you at this time, you can avoid this miscompilation by disabling the Wasm simd proposal

config.wasm_simd(false);

Additionally the bug is only present on x86_64 hosts. Other platforms such as AArch64 and s390x are not affected.

References

For more information

If you have any questions or comments about this advisory:

References

@alexcrichton alexcrichton published to bytecodealliance/wasmtime Mar 8, 2023
Published by the National Vulnerability Database Mar 8, 2023
Published to the GitHub Advisory Database Mar 9, 2023
Reviewed Mar 9, 2023
Last updated Mar 9, 2023

Severity

Low

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
High
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS score

0.156%
(53rd percentile)

Weaknesses

CVE ID

CVE-2023-27477

GHSA ID

GHSA-xm67-587q-r2vw

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.