RUSTSEC-2022-0076: 
Rust vulnerability analysis and mitigation

A vulnerability (RUSTSEC-2022-0076/CVE-2022-39392) was discovered in Wasmtime's implementation of its pooling instance allocator, affecting versions ≤ 2.0.1. The issue occurs when the allocator is configured to give WebAssembly instances a maximum of zero pages of memory. This configuration causes the virtual memory mapping for WebAssembly memories to fail meeting the compiler-required configuration requirements for safely executing WebAssembly modules (GitHub Advisory).

The vulnerability stems from a misconfiguration in Wasmtime's pooling allocator when InstanceLimits::memory_pages is set to zero. Under normal circumstances, Wasmtime relies on virtual memory page faults to indicate out-of-bounds wasm reads/writes. However, with this specific configuration, the pooling allocator creates an improper virtual memory mapping that fails to enforce these boundaries. The vulnerability has been assigned a CVSS score of 5.9 (Moderate), with attack vector being Network, high attack complexity, high privileges required, and no user interaction needed (GitHub Advisory).

When exploited, this vulnerability allows out-of-bounds reads and writes to successfully access memory unrelated to the wasm sandbox within range of the base address of the memory mapping created by the pooling allocator. However, the impact is considered moderate due to the rare nature of the triggering configuration, as most WebAssembly modules require linear memory for operation (GitHub Advisory).

The vulnerability has been patched in Wasmtime version 2.0.2. Alternative workarounds include disabling the pooling allocator (which is not enabled by default) or increasing the memory_pages allotment to a value greater than zero. For cases where prevention of memory usage is still desired, the Store::limiter method can be used to dynamically disallow growth of memory beyond 0 bytes (GitHub Advisory).