Executive Summary

This vulnerability exists in Wasmtime, a runtime for WebAssembly, in versions prior to 24.0.9, 36.0.10, and 44.0.2. When a filesystem preopen is configured with DirPerms::all() and FilePerms::READ but without FilePerms::WRITE, the access control can be bypassed. This happens because the code handling the OpenFlags::TRUNCATE flag did not correctly set the write permission flag during the access control check, allowing a file to be opened with truncation even though write permission was not granted.

The root cause is a missing assignment in the code that should have set the open_mode to include write access when the TRUNCATE flag is used. This flaw allows an attacker to bypass the intended read-only restriction and open a file with truncation, effectively modifying it without proper permission.

This issue only affects wasmtime-wasi embeddings that combine DirPerms::MUTATE with FilePerms::READ. The official wasmtime-cli is not affected because it always grants full file permissions for preopens.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow unauthorized modification of files that are intended to be read-only. An attacker could exploit this flaw to truncate and potentially alter files without having explicit write permissions.

Such unauthorized file modifications can lead to data corruption, loss of data integrity, or disruption of application behavior that relies on those files.

Since the vulnerability has a CVSS base score of 7.5 with high impact on integrity, it represents a significant risk in environments where Wasmtime is used with affected versions and configurations.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Wasmtime to version 24.0.9, 36.0.10, or 44.0.2 or later, where the issue has been fixed.

Ensure that any wasmtime-wasi embeddings that combine DirPerms::MUTATE with FilePerms::READ are updated, as these are the affected configurations.

Note that wasmtime-cli's use of wasmtime-wasi is not affected because it always sets FilePerms::all() for all preopens.

Useful 0 Not Useful 0