CVE-2023-27477:
wasmtime vulnerable to miscompilation of `i8x16.select` with the same inputs on x86_64
3.1
CVSS ScoreBasic Information
CVE ID
GHSA ID
EPSS Score
-
CWE
Published
3/9/2023
Updated
3/9/2023
KEV Status
No
Technology
Rust
RustTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| wasmtime | rust | >= 1.0.0, < 4.0.1 | 4.0.1 |
| wasmtime | rust | >= 5.0.0, < 5.0.1 | 5.0.1 |
| wasmtime | rust | >= 6.0.0, < 6.0.1 | 6.0.1 |
| cranelift-codegen | rust | >= 0.88.0, < 0.91.1 | 0.91.1 |
| cranelift-codegen | rust | >= 0.92.0, < 0.92.1 | 0.92.1 |
| cranelift-codegen | rust | >= 0.93.0, < 0.93.1 | 0.93.1 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability was explicitly fixed by modifying the shuffle_0_31_mask function in the commit diff. The critical line changed from b.wrapping_sub(15) to b.wrapping_sub(16) when handling indices >15. This function generates the shuffle mask for x86_64's pshufb instruction, and the off-by-one error directly caused the miscompilation of i8x16.select when selecting lanes from the second vector. No other functions in the provided diffs showed security-relevant changes.