5.3

CVE-2023-41880: bytecodealliance wasmtime Off-by-one Error

CVSS: 5.3v3.1MediumModified
AliasesUBUNTU-CVE-2023-41880DEBIAN-CVE-2023-41880GHSA-gw5p-q8mj-p7gh
Published 15-09-2023Last modified 24-09-2024
Open JSON

Vulnerability summary

CVE-2023-41880 is a medium (CVSS 5.3) Off-by-one Error vulnerability in bytecodealliance wasmtime. EPSS estimates a 0.67% chance of exploitation in the next 30 days, higher than 51.2% of scored vulnerabilities.

Overall risk
21/100
0100
Low · default modelHow is this calculated?
CVSS score
5.3/10
010
Medium · v3.1 (NVD)
EPSS score
0.67%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 15-09-2023
    PublishedVulnerability first disclosed.
  2. 24-09-2024
    Last modifiedVulnerability information updated.

Description

Wasmtime is a standalone runtime for WebAssembly. Wasmtime versions from 10.0.0 to versions 10.02, 11.0.2, and 12.0.1 contain a miscompilation of the WebAssembly `i64x2.shr_s` instruction on x86_64 platforms when the shift amount is a constant value that is larger than 32. Only x86_64 is affected so all other targets are not affected by this. The miscompilation results in the instruction producing an incorrect result, namely the low 32-bits of the second lane of the vector are derived from the low 32-bits of the second lane of the input vector instead of the high 32-bits. The primary impact of this issue is that any WebAssembly program using the `i64x2.shr_s` with a constant shift amount larger than 32 may produce an incorrect result. This issue is not an escape from the WebAssembly sandbox. Execution of WebAssembly guest programs will still behave correctly with respect to memory sandboxing and isolation from the host. Wasmtime considers non-spec-compliant behavior as a security issue nonetheless. This issue was discovered through fuzzing of Wasmtime's code generator Cranelift. Wasmtime versions 10.0.2, 11.0.2, and 12.0.2 are all patched to no longer have this miscompilation. This issue only affects x86_64 hosts and the only workaround is to either scan for this pattern in wasm modules which is nontrivial or to disable the SIMD proposal for WebAssembly. Users prior to 10.0.0 are unaffected by this vulnerability.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.67%

Chance of exploitation in the next 30 days

Percentile

51%

Versus all other CVEs

30-day change

0.00 pp

From 0.67% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.67%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Bytecodealliance1 product
  • wasmtime≥ 10.0.0, < 10.0.2 | ≥ 11.0.0, < 11.0.2 | ≥ 12.0.0, < 12.0.2
Crates.Io1 product
  • wasmtime≥ 10.0.0, < 10.0.2 | ≥ 11.0.0, < 11.0.2 | ≥ 12.0.0, < 12.0.2
Debian1 product
  • rust-wasmtime< 15.0.0+dfsg-1
Ubuntu1 product
  • rust-wasmtime< 16.0.0+dfsg-3

4 vendors · 4 products

References

12 links
Show all 12 references