{"id":"GHSA-v4cp-h94r-m7xf","summary":"Use after free passing `externref`s to Wasm in Wasmtime","details":"### Impact\n\nThere was a use-after-free bug when passing `externref`s from the host to guest Wasm content.\n\nTo trigger the bug, you have to explicitly pass multiple `externref`s from the host to a Wasm instance at the same time, either by\n\n* passing multiple `externref`s as arguments from host code to a Wasm function,\n* or returning multiple `externref`s to Wasm from a multi-value return function defined in the host.\n \nIf you do not have host code that matches one of these shapes, then you are not impacted.\n\nIf Wasmtime's [`VMExternRefActivationsTable`](https://github.com/bytecodealliance/wasmtime/blob/37c094faf53f1b356aab3c79d451395e4f7edb34/crates/runtime/src/externref.rs#L493) became filled to capacity after passing the first `externref` in, then passing in the second `externref` could trigger a garbage collection. However the first `externref` is not rooted until we pass control to Wasm, and therefore could be reclaimed by the collector if nothing else was holding a reference to it or otherwise keeping it alive. Then, when control was passed to Wasm after the garbage collection, Wasm could use the first `externref`, which at this point has already been freed.\n\nWe have reason to believe that the effective impact of this bug is relatively small because usage of `externref` is currently quite rare.\n\n### Patches\n\nThe bug has been fixed, and users should upgrade to Wasmtime 0.30.0.\n\nAdditionally, we have updated [our primary `externref` fuzz target](https://github.com/bytecodealliance/wasmtime/blob/37c094faf53f1b356aab3c79d451395e4f7edb34/fuzz/fuzz_targets/table_ops.rs) such that it better exercises these code paths and we can have greater confidence in their correctness going forward.\n\n### Workarounds\n\nIf you cannot upgrade Wasmtime yet, you can avoid the bug by disabling reference types support in Wasmtime by passing `false` to [`wasmtime::Config::wasm_reference_types`](https://docs.rs/wasmtime/0.29.0/wasmtime/struct.Config.html#method.wasm_reference_types).\n\n### References\n\n* [The reference types Wasm proposal, which introduces `externref`](https://github.com/WebAssembly/reference-types/)\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Reach out to us on [the Bytecode Alliance Zulip chat](https://bytecodealliance.zulipchat.com/#narrow/stream/217126-wasmtime)\n* Open an issue in [the `bytecodealliance/wasmtime` repository](https://github.com/bytecodealliance/wasmtime/)","aliases":["CVE-2021-39216","CVE-2021-39218","CVE-2021-39219","GHSA-4873-36h9-wv49","GHSA-q879-9g95-56mx","PYSEC-2021-320","PYSEC-2021-321","PYSEC-2021-322","RUSTSEC-2021-0110"],"modified":"2026-07-08T06:29:18.419386524Z","published":"2021-09-20T19:54:05Z","database_specific":{"nvd_published_at":"2021-09-17T20:15:00Z","cwe_ids":["CWE-416"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2021-09-17T20:05:21Z"},"references":[{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-v4cp-h94r-m7xf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39216"},{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/commit/101998733b74624cbd348a2366d05760b40181f3"},{"type":"WEB","url":"https://crates.io/crates/wasmtime"},{"type":"PACKAGE","url":"https://github.com/bytecodealliance/wasmtime"},{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime-py/compare/0.29.0...0.30.0"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/wasmtime/PYSEC-2021-320.yaml"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WAVBRYDDUIY2ZR3K3FO4BVYJKIMJ5TP7"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z2Z33FTXFQ6EOINVEQIP4DFBG53G5XIY"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2021-0110.html"}],"affected":[{"package":{"name":"wasmtime","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.30.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-v4cp-h94r-m7xf/GHSA-v4cp-h94r-m7xf.json"}},{"package":{"name":"wasmtime","ecosystem":"PyPI","purl":"pkg:pypi/wasmtime"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.30.0"}]}],"versions":["0.0.1","0.0.2","0.11.0","0.12.0","0.15.0","0.15.1","0.16.0","0.16.1","0.17.0","0.18.0","0.18.1","0.18.2","0.19.0","0.20.0","0.21.0","0.22.0","0.23.0","0.24.0","0.25.0","0.26.0","0.27.0","0.28.0","0.28.1","0.29.0","0.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-v4cp-h94r-m7xf/GHSA-v4cp-h94r-m7xf.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"}]}