N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-9ghp-w2hm-vfpf

GHSA-9ghp-w2hm-vfpf: wasmtime_jit_debug Dumps Undefined Memory by `JitDumpFile`

The unsound function dump_code_load_record uses from_raw_parts to directly convert the pointer addr and len into a slice without any validation and that memory block would be dumped.

Thus, the 'safe' function dump_code_load_record is actually 'unsafe' since it requires the caller to guarantee that the addr is valid and len must not overflow. Otherwise, the function could dump the memory into file illegally, causing memory leak.

Note: this is an internal-only crate in the Wasmtime project not intended for external use and is more strongly signaled nowadays as of bytecodealliance/wasmtime#10963. Please open an issue in Wasmtime if you're using this crate directly.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-9ghp-w2hm-vfpf

GHSA-9ghp-w2hm-vfpf:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
wasmtime-jit-debug	rust	< 24.0.0	24.0.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, as described and confirmed by the patch, lies in the dump_code_load_record function within the wasmtime_jit_debug::perf_jitdump module. Specifically, the function previously accepted a raw pointer (addr: *const u8) and a length (len: usize) and unsafely converted these into a byte slice using std::slice::from_raw_parts. This operation is unsafe because it relies on the caller to ensure the validity of the pointer and length, which was not guaranteed. If invalid parameters were passed, the function could read from arbitrary memory locations, leading to an information leak (undefined memory dump).

The patch addresses this by refactoring the function to accept a safe slice (code: &[u8]) directly. This change shifts the responsibility of ensuring memory safety to the Rust compiler and the caller providing the slice, eliminating the direct unsafe memory operation within dump_code_load_record. The commit b5e31a5c33725ab8a7dfbe8505c56b5cf282ffed clearly shows the removal of the unsafe block and the from_raw_parts call in this function, along with changes to its callers in other profiling agents to propagate the safer &[u8] type. Therefore, wasmtime_jit_debug::perf_jitdump::JitDumpFile::dump_code_load_record is the function that contained the exploitable unsafe code.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.