CVE-2024-30266: Insufficient Information (NVD-CWE-noinfo)
value: wasmtime is a runtime for WebAssembly. The 19.0.0 release of Wasmtime contains a regression introduced during its development which can lead to a guest WebAssembly module causing a panic in the host runtime. A valid WebAssembly module, when executed at runtime, may cause this panic. This vulnerability has been patched in version 19.0.1.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-04T16:15Z
Repository: https://github.com/bytecodealliance/wasmtime
Language: Rust
Files changed: crates/runtime/src/instance.rs, tests/misc_testsuite/externref-table-dropped-segment-issue-8281.wast
Commit date: 2024-04-02 15:56:49 +0000
Commit message: Fix a panic using tables with the wrong type (#8283)

This commit fixes an accidental issue introduced in #8018 where using an
element segment which had been dropped with an `externref` table would
cause a panic. The panic happened due to an assertion that tables are
being used with the right type of item and that was being mismatched.
The underlying issue was that dropped element segments are modeled as an
empty element segment but the empty element segment was using the
"functions" encoding as opposed to the "expressions" encoding. This
meant that code later assumed that due to the use of functions the table
must be a table-of-functions, but this was not correct for
externref-based tables.

The fix in this commit is to instead model the encoding as an
"expressions" list which means that the table type is dispatched on to
call the appropriate initializer.

There is no memory safety issue with this mistake as the assertion was
specifically targetted at preventing memory safety. This does, however,
enable any WebAssembly module to panic a host.

Closes #8281
Diff: diff --git a/crates/runtime/src/instance.rs b/crates/runtime/src/instance.rs
index cf81701fd7e..0faa14d7c04 100644
--- a/crates/runtime/src/instance.rs
+++ b/crates/runtime/src/instance.rs
@@ -799,11 +799,16 @@ impl Instance {
         // TODO: this `clone()` shouldn't be necessary but is used for now to
         // inform `rustc` that the lifetime of the elements here are
         // disconnected from the lifetime of `self`.
         let module = self.module().clone();
 
-        let empty = TableSegmentElements::Functions(Box::new([]));
+        // NB: fall back to an expressions-based list of elements which doesn't
+        // have static type information (as opposed to `Functions`) since we
+        // don't know just yet what type the table has. The type will be be
+        // inferred in the next step within `table_init_segment`.
+        let empty = TableSegmentElements::Expressions(Box::new([]));
+
         let elements = match module.passive_elements_map.get(&elem_index) {
             Some(index) if !self.dropped_elements.contains(elem_index) => {
                 &module.passive_elements[*index]
             }
             _ => &empty,
diff --git a/tests/misc_testsuite/externref-table-dropped-segment-issue-8281.wast b/tests/misc_testsuite/externref-table-dropped-segment-issue-8281.wast
new file mode 100644
index 00000000000..723c03c801e
--- /dev/null
+++ b/tests/misc_testsuite/externref-table-dropped-segment-issue-8281.wast
@@ -0,0 +1,39 @@
+(module
+  (table $t 0 0 externref)
+
+  (func (export "f1")
+    (i32.const 0)
+    (i32.const 0)
+    (i32.const 0)
+    (table.init $t $declared)
+  )
+
+  (func (export "f2")
+    (i32.const 0)
+    (i32.const 0)
+    (i32.const 0)
+    (table.init $t $passive)
+
+    (elem.drop $passive)
+
+    (i32.const 0)
+    (i32.const 0)
+    (i32.const 0)
+    (table.init $t $passive)
+  )
+
+  (func (export "f3")
+    (i32.const 0)
+    (i32.const 0)
+    (i32.const 0)
+    (table.init $t $active)
+  )
+
+  (elem $declared declare externref)
+  (elem $passive externref)
+  (elem $active (i32.const 0) externref)
+)
+
+(assert_return (invoke "f1"))
+(assert_return (invoke "f2"))
+(assert_return (invoke "f3"))

Vulnerable code:         let empty = TableSegmentElements::Functions(Box::new([]));
Fixed code:         // NB: fall back to an expressions-based list of elements which doesn't
        // have static type information (as opposed to `Functions`) since we
        // don't know just yet what type the table has. The type will be be
        // inferred in the next step within `table_init_segment`.
        let empty = TableSegmentElements::Expressions(Box::new([]));

(module
  (table $t 0 0 externref)

  (func (export "f1")
    (i32.const 0)
    (i32.const 0)
    (i32.const 0)
    (table.init $t $declared)
  )

  (func (export "f2")
    (i32.const 0)
    (i32.const 0)
    (i32.const 0)
    (table.init $t $passive)

    (elem.drop $passive)

    (i32.const 0)
    (i32.const 0)
    (i32.const 0)
    (table.init $t $passive)
  )

  (func (export "f3")
    (i32.const 0)
    (i32.const 0)
    (i32.const 0)
    (table.init $t $active)
  )

  (elem $declared declare externref)
  (elem $passive externref)
  (elem $active (i32.const 0) externref)
)

(assert_return (invoke "f1"))
(assert_return (invoke "f2"))
(assert_return (invoke "f3"))