CVE-2023-27477 is a code generation bug in Wasmtime's Cranelift backend, specifically affecting the WebAssembly i8x16.select instruction on x86_64 platforms. This flaw, an off-by-one error in mask calculation, leads to incorrect results when specific conditions are met, impacting bytecodealliance cranelift-codegen and wasmtime. With a CVSS score of 4.3 (MEDIUM), the vulnerability has a network attack vector and low attack complexity, requiring low privileges and no user interaction. Its potential impact is limited to low integrity, with no confidentiality or availability impact. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE. Users are advised to upgrade to Wasmtime versions 6.0.1, 5.0.1, or 4.0.1, or disable the Wasm SIMD proposal as a workaround.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 0.84.0, < 0.91.1CPE matchmatch criteria | cpe:2.3:a:bytecodealliance:cranelift-codegen:*:*:*:*:*:rust:*:* | ||
0.92.0CPE matchmatch criteria | cpe:2.3:a:bytecodealliance:cranelift-codegen:0.92.0:*:*:*:*:rust:*:* | ||
0.93.0CPE matchmatch criteria | cpe:2.3:a:bytecodealliance:cranelift-codegen:0.93.0:*:*:*:*:rust:*:* | ||
>= 0.37.0, < 4.0.1CPE matchmatch criteria | cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:* | ||
5.0.0CPE matchmatch criteria | cpe:2.3:a:bytecodealliance:wasmtime:5.0.0:*:*:*:*:rust:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2023-27477
May 9, 2023wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's code generation backend Cranelift has a bug on x86_64 platforms for the WebAssembly `i8x16.select` instruction which will produce the wrong results when the same operand is provided to the instruction and some of the selected indices are greater than 16. There is an off-by-one error in the calculation of the mask to the `pshufb` instruction which causes incorrect results to be returned if lanes are selected from the second vector. This codegen bug has been fixed in Wasmtiem 6.0.1 5.0.1 and 4.0.1. Users are recommended to upgrade to these updated versions. If upgrading is not an option for you at this time you can avoid this miscompilation by disabling the Wasm simd proposal. Additionally the bug is only present on x86_64 hosts. Other platforms such as AArch64 and s390x are not affected.
Mar 14, 2023wasmtime vulnerable to miscompilation of `i8x16.select` with the same inputs on x86_64
Mar 9, 2023