🔴 Critical: Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes
-
Two critical vulnerabilities have been disclosed in Wasmtime, a WebAssembly runtime that can be embedded into other software. According to the project's maintainers, both flaws could allow a malicious WebAssembly module to break out of the sandbox that is meant to contain it.
Exploitation requires the attacker to get a vulnerable Wasmtime build to compile a module they control — the flaws are not remotely triggerable on their own. One of the two issues impacts only ARM64 systems, so exposure depends heavily on the underlying architecture in use.
Fixed versions of Wasmtime have been released, and operators running the runtime — directly or as a dependency inside another application — should upgrade to the patched release as soon as possible.
Mitigation guidance:
- Identify any software in your environment that bundles or embeds Wasmtime.
- Upgrade to the fixed release published by the maintainers.
- Pay particular attention to ARM64 deployments, which are affected by one of the two flaws.
- Avoid compiling or running untrusted WebAssembly modules on unpatched builds.
Source: The Hacker News
Does your organization embed Wasmtime in any production software, and have you already patched it?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login