Incorrect Permission Bypass in Wasmtime

Executive Summary

This vulnerability exists in Wasmtime, a runtime for WebAssembly, in versions prior to 24.0.9, 36.0.10, and 44.0.2. When a filesystem preopen is configured with DirPerms::all() and FilePerms::READ but without FilePerms::WRITE, the access control can be bypassed. This happens because the code handling the OpenFlags::TRUNCATE flag did not correctly set the write permission flag during the access control check, allowing a file to be opened with truncation even though write permission was not granted.

The root cause is a missing assignment in the code that should have set the open_mode to include write access when the TRUNCATE flag is used. This flaw allows an attacker to bypass the intended read-only restriction and open a file with truncation, effectively modifying it without proper permission.

This issue only affects wasmtime-wasi embeddings that combine DirPerms::MUTATE with FilePerms::READ. The official wasmtime-cli is not affected because it always grants full file permissions for preopens.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow unauthorized modification of files that are intended to be read-only. An attacker could exploit this flaw to truncate and potentially alter files without having explicit write permissions.

Such unauthorized file modifications can lead to data corruption, loss of data integrity, or disruption of application behavior that relies on those files.

Since the vulnerability has a CVSS base score of 7.5 with high impact on integrity, it represents a significant risk in environments where Wasmtime is used with affected versions and configurations.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Wasmtime to version 24.0.9, 36.0.10, or 44.0.2 or later, where the issue has been fixed.

Ensure that any wasmtime-wasi embeddings that combine DirPerms::MUTATE with FilePerms::READ are updated, as these are the affected configurations.

Note that wasmtime-cli's use of wasmtime-wasi is not affected because it always sets FilePerms::all() for all preopens.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows bypassing write permission restrictions, potentially enabling unauthorized file modifications. This could impact data integrity by allowing changes to files without proper authorization.

While the CVE description and resources do not explicitly mention compliance with standards such as GDPR or HIPAA, unauthorized modification of files could lead to non-compliance with regulations that require strict access controls and data integrity protections.

Therefore, organizations using affected versions of Wasmtime with vulnerable configurations might face increased risk of violating data protection and integrity requirements mandated by such standards.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a bypass of file write permission checks in Wasmtime versions prior to 24.0.9, 36.0.10, and 44.0.2 when using the WASI path_open(TRUNCATE) function with specific permission settings. Detection would involve identifying if your system is running an affected Wasmtime version and if any wasmtime-wasi embeddings use DirPerms::all() with FilePerms::READ but without FilePerms::WRITE on preopened directories.

Since the vulnerability is related to the misuse of the TRUNCATE flag in file open operations, detection could include monitoring or auditing calls to the path_open or open_at interfaces with the OpenFlags::TRUNCATE flag set, especially when the file permissions do not include write access.

There are no specific commands provided in the available resources to detect exploitation attempts or presence of this vulnerability on a system or network.

Useful 0 Not Useful 0