Skip to content

Commit 669a958

Browse files
alexcrichtondjc
alexcrichton
authored and
djc
committed
Import old Wasmtime security advisories
[Wasmtime] recently got a [request] to have our security advisories published on the RustSec database as well. We've got a few old advisories on here but we haven't been keeping up-to-date with later advisories. In lieu of automatic imports from GitHub to RustSec we figured we'd in the interim manually fill in some fields. In this PR I'm back-filling security advisories we've had in Wasmtime into the RustSec database here. The oldest advisory here is 3 years old and the goal is to have this serve as a template for importing future advisories that Wasmtime gets. It's not expected for this to cause any churn or undue warnings but instead is intended to bring RustSec up-to-date with the advisories we have for this crate. [Wasmtime]: https://crates.io/crates/wasmtime [request]: bytecodealliance/wasmtime#10344
1 parent f91c52b commit 669a958

16 files changed

+361
-0
lines changed

‎crates/wasmtime/RUSTSEC-0000-0000.0.md

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
```toml
2+
[advisory]
3+
id = "RUSTSEC-0000-0000"
4+
package = "wasmtime"
5+
date = "2022-03-28"
6+
url = "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gwc9-348x-qwv2"
7+
categories = ["memory-corruption"]
8+
keywords = []
9+
aliases = ["CVE-2022-24791", "GHSA-gwc9-348x-qwv2"]
10+
license = "CC0-1.0"
11+
12+
[versions]
13+
patched = [">= 0.35.2", ">= 0.34.2, < 0.35.0"]
14+
```
15+
16+
# Use after free with `externref`s and epoch interruption in Wasmtime
17+
18+
This is an entry in the RustSec database for the Wasmtime security advisory
19+
located at
20+
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gwc9-348x-qwv2.
21+
For more information see the GitHub-hosted security advisory.

‎crates/wasmtime/RUSTSEC-0000-0000.1.md

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
```toml
2+
[advisory]
3+
id = "RUSTSEC-0000-0000"
4+
package = "wasmtime"
5+
date = "2022-06-27"
6+
url = "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqwc-c49r-4w2x"
7+
categories = []
8+
keywords = []
9+
aliases = ["CVE-2022-31104", "GHSA-jqwc-c49r-4w2x"]
10+
license = "CC0-1.0"
11+
12+
[versions]
13+
patched = [">= 0.38.1"]
14+
```
15+
16+
# Miscompilation of `i8x16.swizzle` and `select` with v128 inputs
17+
18+
This is an entry in the RustSec database for the Wasmtime security advisory
19+
located at
20+
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqwc-c49r-4w2x.
21+
For more information see the GitHub-hosted security advisory.

‎crates/wasmtime/RUSTSEC-0000-0000.10.md

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
```toml
2+
[advisory]
3+
id = "RUSTSEC-0000-0000"
4+
package = "wasmtime"
5+
date = "2023-04-21"
6+
url = "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-ch89-5g45-qwc7"
7+
categories = ["memory-corruption"]
8+
keywords = []
9+
aliases = ["CVE-2023-30624", "GHSA-ch89-5g45-qwc7"]
10+
license = "CC0-1.0"
11+
cvss = "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L"
12+
13+
[versions]
14+
patched = [">= 6.0.2, < 7.0.0", ">= 7.0.1, < 8.0.0", ">= 8.0.1"]
15+
```
16+
17+
# Undefined Behavior in Rust runtime functions
18+
19+
This is an entry in the RustSec database for the Wasmtime security advisory
20+
located at
21+
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-ch89-5g45-qwc7.
22+
For more information see the GitHub-hosted security advisory.

‎crates/wasmtime/RUSTSEC-0000-0000.11.md

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
```toml
2+
[advisory]
3+
id = "RUSTSEC-0000-0000"
4+
package = "wasmtime"
5+
date = "2023-09-05"
6+
url = "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gw5p-q8mj-p7gh"
7+
categories = []
8+
keywords = []
9+
aliases = ["CVE-2023-41880", "GHSA-gw5p-q8mj-p7gh"]
10+
license = "CC0-1.0"
11+
cvss = "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N"
12+
13+
[versions]
14+
patched = [">= 10.0.2, < 11.0.0", ">= 11.0.2, < 12.0.0", ">= 12.0.2"]
15+
```
16+
17+
# Miscompilation of wasm `i64x2.shr_s` instruction with constant input on x86\_64
18+
19+
This is an entry in the RustSec database for the Wasmtime security advisory
20+
located at
21+
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gw5p-q8mj-p7gh.
22+
For more information see the GitHub-hosted security advisory.

‎crates/wasmtime/RUSTSEC-0000-0000.12.md

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
```toml
2+
[advisory]
3+
id = "RUSTSEC-0000-0000"
4+
package = "wasmtime"
5+
date = "2024-04-02"
6+
url = "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-75hq-h6g9-h4q5"
7+
categories = []
8+
keywords = []
9+
aliases = ["CVE-2024-30266", "GHSA-75hq-h6g9-h4q5"]
10+
license = "CC0-1.0"
11+
cvss = "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
12+
13+
[versions]
14+
patched = [">= 19.0.1"]
15+
unaffected = ["< 19.0.0"]
16+
```
17+
18+
# Panic when using a dropped extenref-typed element segment
19+
20+
This is an entry in the RustSec database for the Wasmtime security advisory
21+
located at
22+
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-75hq-h6g9-h4q5.
23+
For more information see the GitHub-hosted security advisory.

‎crates/wasmtime/RUSTSEC-0000-0000.13.md

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
```toml
2+
[advisory]
3+
id = "RUSTSEC-0000-0000"
4+
package = "wasmtime"
5+
date = "2024-10-02"
6+
url = "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q8hx-mm92-4wvg"
7+
categories = []
8+
keywords = []
9+
aliases = ["CVE-2024-47763", "GHSA-q8hx-mm92-4wvg"]
10+
license = "CC0-1.0"
11+
cvss = "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
12+
13+
[versions]
14+
patched = [
15+
">= 21.0.2, < 22.0.0",
16+
">= 22.0.1, < 23.0.0",
17+
">= 23.0.3, < 24.0.0",
18+
">= 24.0.1, < 25.0.0",
19+
">= 25.0.2",
20+
]
21+
unaffected = ["< 21.0.0"]
22+
```
23+
24+
# Runtime crash when combining tail calls with stack traces
25+
26+
This is an entry in the RustSec database for the Wasmtime security advisory
27+
located at
28+
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q8hx-mm92-4wvg.
29+
For more information see the GitHub-hosted security advisory.

‎crates/wasmtime/RUSTSEC-0000-0000.14.md

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
```toml
2+
[advisory]
3+
id = "RUSTSEC-0000-0000"
4+
package = "wasmtime"
5+
date = "2024-10-03"
6+
url = "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7qmx-3fpx-r45m"
7+
categories = []
8+
keywords = []
9+
aliases = ["CVE-2024-47813", "GHSA-7qmx-3fpx-r45m"]
10+
license = "CC0-1.0"
11+
cvss = "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L"
12+
13+
[versions]
14+
patched = [
15+
">= 21.0.2, < 22.0.0",
16+
">= 22.0.1, < 23.0.0",
17+
">= 23.0.3, < 24.0.0",
18+
">= 24.0.1, < 25.0.0",
19+
">= 25.0.2",
20+
]
21+
unaffected = ["< 19.0.0"]
22+
```
23+
24+
# Race condition could lead to WebAssembly control-flow integrity and type safety violations
25+
26+
This is an entry in the RustSec database for the Wasmtime security advisory
27+
located at
28+
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7qmx-3fpx-r45m.
29+
For more information see the GitHub-hosted security advisory.

‎crates/wasmtime/RUSTSEC-0000-0000.15.md

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
```toml
2+
[advisory]
3+
id = "RUSTSEC-0000-0000"
4+
package = "wasmtime"
5+
date = "2024-11-02"
6+
url = "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-c2f5-jxjv-2hh8"
7+
categories = []
8+
keywords = []
9+
aliases = ["CVE-2024-51745", "GHSA-c2f5-jxjv-2hh8"]
10+
license = "CC0-1.0"
11+
12+
[versions]
13+
patched = [">= 24.0.2, < 25.0.0", ">= 25.0.3, < 26.0.0", ">= 26.0.1"]
14+
```
15+
16+
# Wasmtime doesn't fully sandbox all the Windows device filenames
17+
18+
This is an entry in the RustSec database for the Wasmtime security advisory
19+
located at
20+
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-c2f5-jxjv-2hh8.
21+
For more information see the GitHub-hosted security advisory.

‎crates/wasmtime/RUSTSEC-0000-0000.2.md

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
```toml
2+
[advisory]
3+
id = "RUSTSEC-0000-0000"
4+
package = "wasmtime"
5+
date = "2022-07-05"
6+
url = "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7f6x-jwh5-m9r4"
7+
categories = []
8+
keywords = []
9+
aliases = ["CVE-2022-23636", "GHSA-7f6x-jwh5-m9r4"]
10+
license = "CC0-1.0"
11+
12+
[versions]
13+
patched = [">= 0.38.2"]
14+
```
15+
16+
# Miscompilation of constant values in division on AArch64
17+
18+
This is an entry in the RustSec database for the Wasmtime security advisory
19+
located at
20+
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7f6x-jwh5-m9r4.
21+
For more information see the GitHub-hosted security advisory.

‎crates/wasmtime/RUSTSEC-0000-0000.3.md

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
```toml
2+
[advisory]
3+
id = "RUSTSEC-0000-0000"
4+
package = "wasmtime"
5+
date = "2022-07-12"
6+
url = "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5fhj-g3p3-pq9g"
7+
categories = ["memory-corruption"]
8+
keywords = []
9+
aliases = ["CVE-2022-31146", "GHSA-5fhj-g3p3-pq9g"]
10+
license = "CC0-1.0"
11+
12+
[versions]
13+
patched = [">= 0.38.2"]
14+
```
15+
16+
# Use After Free with `externref`s in Wasmtime
17+
18+
This is an entry in the RustSec database for the Wasmtime security advisory
19+
located at
20+
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5fhj-g3p3-pq9g.
21+
For more information see the GitHub-hosted security advisory.

‎crates/wasmtime/RUSTSEC-0000-0000.4.md

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
```toml
2+
[advisory]
3+
id = "RUSTSEC-0000-0000"
4+
package = "wasmtime"
5+
date = "2022-11-05"
6+
url = "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-44mr-8vmm-wjhg"
7+
categories = []
8+
keywords = []
9+
aliases = ["CVE-2022-39392", "GHSA-44mr-8vmm-wjhg"]
10+
license = "CC0-1.0"
11+
cvss = "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N"
12+
13+
[versions]
14+
patched = [">= 1.0.2, < 2.0.0", ">= 2.0.2"]
15+
```
16+
17+
# Out of bounds read/write with zero-memory-pages configuration
18+
19+
This is an entry in the RustSec database for the Wasmtime security advisory
20+
located at
21+
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-44mr-8vmm-wjhg.
22+
For more information see the GitHub-hosted security advisory.

‎crates/wasmtime/RUSTSEC-0000-0000.5.md

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
```toml
2+
[advisory]
3+
id = "RUSTSEC-0000-0000"
4+
package = "wasmtime"
5+
date = "2022-11-05"
6+
url = "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wh6w-3828-g9qf"
7+
categories = []
8+
keywords = []
9+
aliases = ["CVE-2022-39393", "GHSA-wh6w-3828-g9qf"]
10+
license = "CC0-1.0"
11+
cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
12+
13+
[versions]
14+
patched = [">= 1.0.2, < 2.0.0", ">= 2.0.2"]
15+
```
16+
17+
# Data leakage between instances in the pooling allocator
18+
19+
This is an entry in the RustSec database for the Wasmtime security advisory
20+
located at
21+
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wh6w-3828-g9qf.
22+
For more information see the GitHub-hosted security advisory.

‎crates/wasmtime/RUSTSEC-0000-0000.6.md

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
```toml
2+
[advisory]
3+
id = "RUSTSEC-0000-0000"
4+
package = "wasmtime"
5+
date = "2022-11-07"
6+
url = "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-h84q-m8rr-3v9q"
7+
categories = []
8+
keywords = []
9+
aliases = ["CVE-2022-39394", "GHSA-h84q-m8rr-3v9q"]
10+
license = "CC0-1.0"
11+
cvss = "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L"
12+
13+
[versions]
14+
patched = [">= 1.0.2, < 2.0.0", ">= 2.0.2"]
15+
```
16+
17+
# Out of bounds write in `wasmtime_trap_code` C API function
18+
19+
This is an entry in the RustSec database for the Wasmtime security advisory
20+
located at
21+
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-h84q-m8rr-3v9q.
22+
For more information see the GitHub-hosted security advisory.

‎crates/wasmtime/RUSTSEC-0000-0000.7.md

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
```toml
2+
[advisory]
3+
id = "RUSTSEC-0000-0000"
4+
package = "wasmtime"
5+
date = "2023-03-02"
6+
url = "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-ff4p-7xrq-q5r8"
7+
categories = ["memory-corruption"]
8+
keywords = []
9+
aliases = ["CVE-2023-26489", "GHSA-ff4p-7xrq-q5r8"]
10+
license = "CC0-1.0"
11+
cvss = "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
12+
13+
[versions]
14+
patched = [">= 4.0.1, < 5.0.0", ">= 5.0.1, < 6.0.0", ">= 6.0.1"]
15+
```
16+
17+
# Guest-controlled out-of-bounds read/write on x86\_64
18+
19+
This is an entry in the RustSec database for the Wasmtime security advisory
20+
located at
21+
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-ff4p-7xrq-q5r8.
22+
For more information see the GitHub-hosted security advisory.

‎crates/wasmtime/RUSTSEC-0000-0000.8.md

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
```toml
2+
[advisory]
3+
id = "RUSTSEC-0000-0000"
4+
package = "wasmtime"
5+
date = "2023-03-03"
6+
url = "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-xm67-587q-r2vw"
7+
categories = []
8+
keywords = []
9+
aliases = ["CVE-2023-27477", "GHSA-xm67-587q-r2vw"]
10+
license = "CC0-1.0"
11+
cvss = "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
12+
13+
[versions]
14+
patched = [">= 4.0.1, < 5.0.0", ">= 5.0.1, < 6.0.0", ">= 6.0.1"]
15+
```
16+
17+
# Miscompilation of `i8x16.select` with the same inputs on x86\_64
18+
19+
This is an entry in the RustSec database for the Wasmtime security advisory
20+
located at
21+
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-xm67-587q-r2vw.
22+
For more information see the GitHub-hosted security advisory.

‎crates/wasmtime/RUSTSEC-0000-0000.md

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
```toml
2+
[advisory]
3+
id = "RUSTSEC-0000-0000"
4+
package = "wasmtime"
5+
date = "2022-02-17"
6+
url = "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-88xq-w8cq-xfg7"
7+
categories = ["memory-corruption"]
8+
keywords = []
9+
aliases = ["CVE-2022-23636", "GHSA-88xq-w8cq-xfg7"]
10+
license = "CC0-1.0"
11+
12+
[versions]
13+
patched = [">= 0.33.1, < 0.34.0", ">= 0.34.1"]
14+
```
15+
16+
# Invalid drop of VMExternRef from partially-initialized instances in the pooling instance allocator
17+
18+
This is an entry in the RustSec database for the Wasmtime security advisory
19+
located at
20+
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-88xq-w8cq-xfg7.
21+
For more information see the GitHub-hosted security advisory.

0 commit comments

Comments
 (0)