bytecodealliance wasmtime up to 24.0.1/25.0.2/26.0.0 incomplete blacklist

Summaryinfo

A vulnerability marked as critical has been reported in bytecodealliance wasmtime up to 24.0.1/25.0.2/26.0.0. Affected by this issue is some unknown functionality. This manipulation causes incomplete blacklist. This vulnerability appears as CVE-2024-51745. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in bytecodealliance wasmtime up to 24.0.1/25.0.2/26.0.0. It has been declared as critical. Affected by this vulnerability is an unknown code. The manipulation with an unknown input leads to a incomplete blacklist vulnerability. The CWE definition for the vulnerability is CWE-184. The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete, leading to resultant weaknesses. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however it did not block access to the special device filenames which use superscript digits, such as "COM¹", "COM²", "LPT⁰", "LPT¹", and so on. Untrusted Wasm programs that are given access to any filesystem directory could bypass the sandbox and access devices through those special device filenames with superscript digits, and through them gain access peripheral devices connected to the computer, or network resources mapped to those devices. This can include modems, printers, network printers, and any other device connected to a serial or parallel port, including emulated USB serial ports. Patch releases for Wasmtime have been issued as 24.0.2, 25.0.3, and 26.0.1. Users of Wasmtime 23.0.x and prior are recommended to upgrade to one of these patched versions. There are no known workarounds for this issue. Affected Windows users are recommended to upgrade.

The advisory is shared at github.com. This vulnerability is known as CVE-2024-51745 since 10/31/2024. The exploitation appears to be easy. The attack can be launched remotely. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1562.006 for this issue.

Upgrading to version 24.0.2 or 25.0.3 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• bytecodealliance

Name

• wasmtime

Version

• 24.0.0
• 24.0.1
• 25.0.0
• 25.0.1
• 25.0.2
• 26.0

Website

• Product: https://github.com/bytecodealliance/wasmtime/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion