rustsec/advisory-db
1
0
Fork 0
mirror of https://github.com/rustsec/advisory-db.git synced 2025-12-27 01:54:07 -05:00
Code Issues Packages Projects Releases Wiki Activity

Add advisory for unsound problem in wasmtime_jit_debug (#1999)

Browse Source 
Co-authored-by: lihuan <lihuan0530@gmail.com>
This commit is contained in:
Safe4U
2025-06-17 17:02:40 +08:00
committed by GitHub
parent 02e6496f7c
commit a5f88f0b07
1 changed files with 30 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
crates/wasmtime-jit-debug/RUSTSEC-0000-0000.md Normal file
View File

@@ -0,0 +1,30 @@
```toml
[advisory]
id = "RUSTSEC-0000-0000"
package = "wasmtime-jit-debug"
date = "2024-07-06"
url = "https://github.com/bytecodealliance/wasmtime/issues/8905"
informational = "unsound"
categories = ["memory-exposure"]
[affected]
functions = { "wasmtime_jit_debug::perf_jitdump::JitDumpFile::dump_code_load_record" = ["<= 24.0.0"] }
[versions]
patched = [">= 24.0.0"]
```
# Dump Undefined Memory by `JitDumpFile`
The unsound function `dump_code_load_record` uses `from_raw_parts` to directly convert
the pointer `addr` and `len` into a slice without any validation and that memory block
would be dumped.
Thus, the 'safe' function dump_code_load_record is actually 'unsafe' since it requires
the caller to guarantee that the addr is valid and len must not overflow.
Otherwise, the function could dump the memory into file illegally, causing memory leak.
> **Note**: this is an internal-only crate in the Wasmtime project not intended for
external use and is more strongly signaled nowadays as of
[bytecodealliance/wasmtime#10963](https://github.com/bytecodealliance/wasmtime/pull/10963).
Please open an issue in Wasmtime if you're using this crate directly.