x.comthreadlee1981 (@lee1981b) on X
Reply on X explaining a Bytecode Alliance advisory for Wasmtime's Cranelift compiler backend. A large or crafted Wasm function that generates enough SSA values overflows Cranelift's value-index representation, which packed indices into 24-bit fields. The fix widens them to 32 bits. The issue is not AArch64-specific, and the advisory names no required optimisation level. Guard pages do not reliably stop the resulting miscompilation and type confusion, so a sandbox escape can arise at compile time.
TL;DR Explains the Wasmtime Cranelift advisory: a 24-bit SSA value-index overflow causes miscompilation and possible sandbox escape on all architectures.
Organisations named here
- Bytecode Alliance
- type confusion
Technologies named here
- Cranelift
- Wasmtime
- WebAssembly
Techniques named here
- Sandbox escape
- Integer Overflow
Related in AppSec
github.comadvisoryFlowise MCP Security Bypass Enables RCE
huntress.comwriteupInside an Oracle Database SQL Injection Attack | Huntress
github.comrepoOASIS
blog.trailofbits.comwriteup