Executive brief
Wasmtime is a runtime for executing WebAssembly code. A vulnerability exists where a specially crafted WebAssembly module can cause the host application to crash when using certain function call features. This results in a denial-of-service, potentially disrupting services that rely on Wasmtime to run untrusted code.
Technical details
A reachable assertion (CWE-617) exists in Wasmtime's stack-walking code when WebAssembly tail calls are enabled. The vulnerability is triggered when an exported function performs a tail call (`return_call`, `return_call_indirect`, or `return_call_ref`) to an imported host function that subsequently captures a stack trace (e.g., by raising a trap). The stack-walker incorrectly assumes at least one WebAssembly frame exists on the stack, which tail calls can invalidate, leading to a Rust panic. On Wasmtime compiled with Rust 1.80 or earlier, this may result in undefined behavior during unwinding; on Rust 1.81+, it results in a deterministic process abort. Patches are available in versions 21.0.2, 22.0.1, 23.0.3, 24.0.1, and 25.0.2.
Affected products
- Bytecode Alliance Wasmtime >= 12.0.0, < 21.0.2; >= 22.0.0, < 22.0.1; >= 23.0.0, < 23.0.3; >= 24.0.0, < 24.0.1; >= 25.0.0, < 25.0.2
Timeline
- 2024-10-09: disclosed
- 2024-10-09: advisory
- 2024-10-09: patched