Incorrect File Permissions in Wasmtime WASI Allow Host File Overwrite

Mitigation Strategies

To mitigate this vulnerability, update Wasmtime to one of the fixed versions: 24.0.11, 36.0.12, 45.0.3, or 46.0.1.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized modification of host files by a WASI guest that should only have read-only access. This means an attacker or malicious code running in the WASI environment could overwrite files on the host system that are intended to be protected, potentially leading to data corruption, loss of integrity, or other security issues.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in Wasmtime, a runtime for WebAssembly, specifically in the wasmtime-wasi component before certain fixed versions. The issue involves the handling of hard-link creation and renaming operations where directory permissions are checked but the file permissions (FilePerms) on the source and destination preopens are not properly matched. This flaw allows a WASI guest with only read-only access to a source file to overwrite host files that are exposed as read-only through the wasip1, wasip2, or wasip3 filesystem interfaces.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves improper permission checks during hard link creation and file renaming in Wasmtime's WASI filesystem implementation, allowing a read-only file to be overwritten by creating hard links or renaming files across permission domains.

Detection would involve monitoring or testing attempts to create hard links or rename files from a read-only permission domain into a read-write permission domain within the Wasmtime WASI environment.

Specifically, you can test if operations like `path_link` or `path_rename` fail with permission errors (`ERRNO_PERM` or `NotPermitted`) when crossing permission boundaries. If these operations succeed, the system is vulnerable.

Since this is a vulnerability in the Wasmtime WASI runtime, detection commands would be part of test programs or scripts that attempt to create hard links or rename files across permission domains within the Wasmtime environment.

No direct network detection commands are provided in the resources, but you can verify the Wasmtime version installed on your system and ensure it is updated to one of the patched versions: 24.0.11, 36.0.12, 45.0.3, or 46.0.1.

For example, to check the Wasmtime version, you can run:

• `wasmtime --version`

If the version is older than the patched versions, your system is vulnerable.

To detect exploitation attempts, you would need to monitor logs or behavior for unexpected file modifications in read-only directories or attempts to create hard links or rename files that should be restricted.

Useful 0 Not Useful 0