CVE-2021-39219 : Exploit Details and Defense Strategies

Wasmtime before version 0.30.0, an open-source runtime for WebAssembly & WASI, is affected by a type confusion vulnerability. This CVE has a base score of 6.3 (Medium severity).

Understanding CVE-2021-39219

Wasmtime is impacted by a type confusion vulnerability leading to the wrong type for

Linker

-defined functions when used across two

Engine

s.

What is CVE-2021-39219?

The vulnerability in Wasmtime allows for type confusion when using different

Engine

instances with a

Linker

, enabling the safe calling of a function with the wrong type.

The Impact of CVE-2021-39219

This vulnerability has a CVSS base score of 6.3, with high integrity impact and availability impact. It requires local access and no privileges, with user interaction needed for exploitation.

Technical Details of CVE-2021-39219

Wasmtime's vulnerability arises due to the unsafe usage of

Linker

with multiple

Engine

instances.

Vulnerability Description

The issue occurs when one

Engine

is used to create the

Linker

, and a different

Engine

is used to create a

Store

, leading to type confusion of function pointers.

Affected Systems and Versions

Product: wasmtime
Vendor: bytecodealliance
Versions: <= 0.29.0

Exploitation Mechanism

Requires the usage of at least two

Engine

values in an embedding, with two different values with a

Linker

.
Impact can be mitigated by upgrading to Wasmtime version 0.30.0 or auditing code to ensure one

Engine

is used with

Linker

.

Mitigation and Prevention

Ways to mitigate and prevent the CVE-2021-39219 vulnerability:

Immediate Steps to Take

Upgrade to Wasmtime version 0.30.0.
If unable to upgrade, ensure only one

Engine

is used with

Linker

.

Long-Term Security Practices

Regularly audit code to prevent

Linker

misuse across different

Engine

instances.

Patching and Updates

Patch has been implemented in Wasmtime version 0.30.0 to address the type confusion vulnerability.