CVE-2022-31146

MEDIUM6.4EPSS 0.41%

Use After Free with `externref`s in Wasmtime

Published: 7/20/2022Modified: 5/2/2025

Also known as:GHSA-5fhj-g3p3-pq9gRUSTSEC-2022-0100

Description

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5fhj-g3p3-pq9g. For more information see the GitHub-hosted security advisory.

Affected packages (3)

crates.io/cranelift-codegen>= 0.84.0, < 0.85.2
crates.io/wasmtime>= 0.37.0, < 0.38.2
crates.io/wasmtime>= 0.0.0-0, < 0.38.2

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM6.4	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L

References (7)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-31146
PATCHhttps://crates.io/crates/wasmtime
PATCHhttps://github.com/bytecodealliance/wasmtime
WEBhttps://github.com/bytecodealliance/wasmtime/commit/2ba4bce5cc719e5a74e571a534424614e62ecc41
WEBhttps://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5fhj-g3p3-pq9g
WEBhttps://github.com/WebAssembly/reference-types
WEBhttps://rustsec.org/advisories/RUSTSEC-2022-0100.html