CVE-2021-32629

CVE-2021-32629 is a bug in Cranelift's x64 backend (versions 0.73 and earlier with specific build flags) that can lead to a sandbox escape in WebAssembly (Wasm) programs. This occurs when a sign-extend operation is performed instead of a zero-extend on a spilled and reloaded integer value under specific conditions, potentially allowing access to memory addresses outside the Wasm program's intended heap. The vulnerability affects bytecodealliance cranelift-codegen and can impact products like Lucet and Wasmtime. With a CVSS score of 8.8 (HIGH), this vulnerability has a local attack vector (AV:L) and low attack complexity (AC:L), requiring low privileges (PR:L) and no user interaction (UI:N). It can result in high confidentiality, integrity, and availability impacts (C:H/I:H/A:H) due to potential memory access up to 2GiB before the Wasm program heap. However, its impact is mitigated by certain heap implementations, such as those with robust bounds checks or guard regions. Currently, there is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit, Nuclei, or ExploitDB. The vulnerability also shows minimal community discussion or media coverage, suggesting a low level of public attention.