Wasmtime/WASI up to 0.33.0/0.34.0 uninitialized pointer

Summaryinfo

A vulnerability labeled as critical has been found in Wasmtime and WASI up to 0.33.0/0.34.0. The impacted element is an unknown function. The manipulation results in uninitialized pointer. This vulnerability is identified as CVE-2022-23636. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical has been found in Wasmtime and WASI up to 0.33.0/0.34.0. Affected is an unknown part. The manipulation with an unknown input leads to a uninitialized pointer vulnerability. CWE is classifying the issue as CWE-824. The product accesses or uses a pointer that has not been initialized. This is going to have an impact on availability.

The weakness was released 02/17/2022 as GHSA-88xq-w8cq-xfg7. The advisory is available at github.com. This vulnerability is traded as CVE-2022-23636 since 01/19/2022. The technical details are unknown and an exploit is not available.

Upgrading to version 0.33.1 or 0.34.1 eliminates this vulnerability. Applying the patch 886ecc562040bef61faf19438c22285c2d62403a is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• WASI
• Wasmtime

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29
• 0.30
• 0.31
• 0.32
• 0.33
• 0.33.0
• 0.34.0

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion