Skip to content

RUSTSEC-2024-0442: Dump Undefined Memory by JitDumpFile #17

@github-actions

Description

@github-actions
Details
Package wasmtime-jit-debug
Version 15.0.1
Warning unsound
URL bytecodealliance/wasmtime#8905
Patched Versions >=24.0.0
Aliases GHSA-9ghp-w2hm-vfpf

The unsound function dump_code_load_record uses from_raw_parts to directly convert
the pointer addr and len into a slice without any validation and that memory block
would be dumped.

Thus, the 'safe' function dump_code_load_record is actually 'unsafe' since it requires
the caller to guarantee that the addr is valid and len must not overflow.
Otherwise, the function could dump the memory into file illegally, causing memory leak.

Note: this is an internal-only crate in the Wasmtime project not intended for
external use and is more strongly signaled nowadays as of
bytecodealliance/wasmtime#10963.
Please open an issue in Wasmtime if you're using this crate directly.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions