CVE-2022-24791 (Rust, published 2022-03-31T23:15Z)
Description: value: Wasmtime is a standalone JIT-style runtime for WebAssembly, using Cranelift. There is a use after free vulnerability in Wasmtime when both running Wasm that uses externrefs and enabling epoch interruption in Wasmtime. If you are not explicitly enabling epoch interruption (it is disabled by default) then you are not affected. If you are explicitly disabling the Wasm reference types proposal (it is enabled by default) then you are also not affected. The use after free is caused by Cranelift failing to emit stack maps when there are safepoints inside cold blocks. Cold blocks occur when epoch interruption is enabled. Cold blocks are emitted at the end of compiled functions, and change the order blocks are emitted versus defined. This reordering accidentally caused Cranelift to skip emitting some stack maps because it expected to emit the stack maps in block definition order, rather than block emission order. When Wasmtime would eventually collect garbage, it would fail to find live references on the stack because of the missing stack maps, think that they were unreferenced garbage, and therefore reclaim them. Then after the collection ended, the Wasm code could use the reclaimed-too-early references, which is a use after free. Patches have been released in versions 0.34.2 and 0.35.2, which fix the vulnerability. All Wasmtime users are recommended to upgrade to these patched versions. If upgrading is not an option for you at this time, you can avoid the vulnerability by either: disabling the Wasm reference types proposal, config.wasm_reference_types(false); or by disabling epoch interruption if you were previously enabling it. config.epoch_interruption(false).
Severity: MEDIUM (CVSS v3 base score: 9.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/bytecodealliance/wasmtime
Files changed:
cranelift/codegen/src/machinst/vcode.rs
tests/all/funcref.rs
tests/all/gc.rs
tests/all/main.rs
Commit message: Merge pull request from GHSA-gwc9-348x-qwv2

* Run the GC smoketest with epoch support enabled as well.

* Handle safepoints in cold blocks properly.

Currently, the way that we find safepoint slots for a given instruction
relies on the instruction index order in the safepoint list matching the
order of instruction emission.

Previous to the introduction of cold-block support, this was trivially
satisfied by sorting the safepoint list: we emit instructions 0, 1, 2,
3, 4, ..., and so if we have safepoints at instructions 1 and 4, we will
encounter them in that order.

However, cold blocks are supported by swizzling the emission order at
the last moment (to avoid having to renumber instructions partway
through the compilation pipeline), so we actually emit instructions out
of index order when cold blocks are present.

Reference-type support in Wasm in particular uses cold blocks for
slowpaths, and has live refs and safepoints in these slowpaths, so we
can reliably "skip" a safepoint (not emit any metadata for it) in the
presence of reftype usage.

This PR fixes the emission code by building a map from instruction index
to safepoint index first, then doing lookups through this map, rather
than following along in-order as it emits instructions.

Vulnerable code:
        let mut safepoint_idx = 0;
                if safepoint_idx < self.safepoint_insns.len()
                    && self.safepoint_insns[safepoint_idx] == iix
                {
                    if self.safepoint_slots[safepoint_idx].len() > 0 {
                        let stack_map = self.abi.spillslots_to_stack_map(
                            &self.safepoint_slots[safepoint_idx][..],
                            &state,
                        );
                        state.pre_safepoint(stack_map);
                    }
                    safepoint_idx += 1;
        let (mut other_store, other_module) = ref_types_module(r#"(module (func (export "f")))"#)?;
    let (mut store, module) = ref_types_module(&wat)?;
    let store = Store::new(&engine, ());

Fixed code:
use crate::fx::FxHashMap;
        // Map from instruction index to index in
        // `safepoint_slots`. We need this because we emit
        // instructions out-of-order, while the safepoint_insns /
        // safepoint_slots data structures are sorted in instruction
        // order.
        let mut safepoint_indices: FxHashMap<u32, usize> = FxHashMap::default();
        for (safepoint_idx, iix) in self.safepoint_insns.iter().enumerate() {
            // Disregard safepoints that ended up having no live refs.
            if self.safepoint_slots[safepoint_idx].len() > 0 {
                safepoint_indices.insert(*iix, safepoint_idx);
            }
        }

                if let Some(safepoint_idx) = safepoint_indices.get(&iix) {
                    let stack_map = self
                        .abi
                        .spillslots_to_stack_map(&self.safepoint_slots[*safepoint_idx][..], &state);
                    state.pre_safepoint(stack_map);
        false,
        let (mut other_store, other_module) =
            ref_types_module(false, r#"(module (func (export "f")))"#)?;
        false,
    smoke_test_gc_impl(false)
}

#[test]
fn smoke_test_gc_epochs() -> anyhow::Result<()> {
    smoke_test_gc_impl(true)
}

fn smoke_test_gc_impl(use_epochs: bool) -> anyhow::Result<()> {
        use_epochs,
        false,
    let (mut store, module) = ref_types_module(false, &wat)?;
        false,
        false,
        false,
    use_epochs: bool,
    if use_epochs {
        config.epoch_interruption(true);
    }
    let mut store = Store::new(&engine, ());
    if use_epochs {
        store.set_epoch_deadline(1);
    }