CVE-2024-38358: Symlink bypasses filesystem sandbox

June 7, 2024 (updated June 20, 2024)

If the preopened directory has a symlink pointing outside, WASI programs can traverse the symlink and access host filesystem if the caller sets both oflags::creat and rights::fd_write. Programs can also crash the runtime by creating a symlink pointing outside with path_symlink and path_opening the link.

References

github.com/advisories/GHSA-55f3-3qvg-8pv5
github.com/wasmerio/wasmer
github.com/wasmerio/wasmer/commit/b9483d022c602b994103f78ecfe46f017f8ac662
github.com/wasmerio/wasmer/security/advisories/GHSA-55f3-3qvg-8pv5
nvd.nist.gov/vuln/detail/CVE-2024-38358

Code Behaviors & Features

Detect and mitigate CVE-2024-38358 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →