CVE-2022-39393 json
Wasmtime vulnerable to data leakage between instances in the pooling allocator
published 2022-11-05 4 y ago modified 2026-10-12 27 d ago also GHSA-wh6w-3828-g9qf , RUSTSEC-2022-0075 , RUSTSEC-2022-0098 , EUVD-2022-7455
- cvss
- 8.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 61%
- public exploits
- 0
- none known
Summary
Wasmtime is a standalone runtime for WebAssembly. Prior to versions 2.0.2 and 1.0.2, there is a bug in Wasmtime's implementation of its pooling instance allocator where when a linear memory is reused for another instance the initial heap snapshot of the prior instance can be visible, erroneously to the next instance. This bug has been patched and users should upgrade to Wasmtime 2.0.2 and 1.0.2. Other mitigations include disabling the pooling allocator and disabling the `memory-init-cow`.
Patch / fix
- crates.io wasmtime 1.0.2, 2.0.2
- bytecodealliance wasmtime 1.0.2, 2.0.2
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
0.94% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
| NVD | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
| GitHub | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
| OSV | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | wasmtime | >=2.0.0, <2.0.2 <1.0.2 >=0.0.0-0, <1.0.2 |
2.0.2 1.0.2 |
Affected products
- bytecodealliance wasmtime
Classification
References
-
github.com
/bytecodealliance/wasmtime/commit/2614f2e9d2d36805ead8a8da0fa0c6e0d9e428a0
web, patch, third-party-advisory
-
github.com
/bytecodealliance/wasmtime/commit/3535acbf3be032ef1ba0b469b8ab92538a8a18a6
web
-
github.com
/bytecodealliance/wasmtime/security/advisories/GHSA-wh6w-3828-g9qf
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-39393
advisory
-
github.com
/bytecodealliance/wasmtime
package
-
groups.google.com
/a/bytecodealliance.org/g/sec-announce/c/c1HBDDJwNPA
web
-
rustsec.org
/advisories/RUSTSEC-2022-0075.html
web, advisory
-
rustsec.org
/advisories/RUSTSEC-2022-0098.html
web, advisory
-
crates.io
/crates/wasmtime
package
Sources
- CVE List CVE-2022-39393
- GitHub Advisory GHSA-wh6w-3828-g9qf
- NVD CVE-2022-39393
- OSV RUSTSEC-2022-0098
- OSV RUSTSEC-2022-0075
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.